Privilege Dropping / Lowering Errors
Weakness ID: 271 (Weakness Class)Status: Incomplete
+ Description

Description Summary

The software does not drop privileges before passing control of a resource to an actor that does not have those privileges.

Extended Description

In some contexts, a system executing with elevated permissions will hand off a process/file/etc. to another process or user. If the privileges of an entity are not reduced, then elevated privileges are spread throughout a system and possibly to an attacker.

+ Time of Introduction
  • Architecture and Design
  • Implementation
  • Operation
+ Applicable Platforms

Languages

All

+ Likelihood of Exploit

High

+ Observed Examples
ReferenceDescription
CVE-2000-1213Program does not drop privileges after acquiring the raw socket.
CVE-2001-0559Setuid program does not drop privileges after a parsing error occurs, then calls another program to handle the error.
CVE-2001-0787Does not drop privileges in related groups when lowering privileges.
CVE-2002-0080Does not drop privileges in related groups when lowering privileges.
CVE-2001-1029Does not drop privileges before determining access to certain files.
CVE-1999-0813Finger daemon does not drop privileges when executing programs on behalf of the user being fingered.
CVE-1999-1326FTP server does not drop privileges if a connection is aborted during file transfer.
CVE-2000-0172Program only uses seteuid to drop privileges.
CVE-2004-2504Windows program running as SYSTEM does not drop privileges before executing other programs (many others like this, especially involving the Help facility).
CVE-2004-0806Setuid program does not drop privileges before executing program specified in an environment variable.
CVE-2004-0828Setuid program does not drop privileges before processing file specified on command line.
CVE-2004-2070Service on Windows does not drop privileges before using "view file" option, allowing code execution.
+ Potential Mitigations

Phase: Architecture and Design

Ensure that appropriate compartmentalization is built into the system design and that the compartmentalization serves to allow for and further reinforce privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide when it is appropriate to use and to drop system privileges.

Very carefully manage the setting, management and handling of privileges. Explicitly manage trust zones in the software.

Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

+ Weakness Ordinalities
OrdinalityDescription
Primary
(where the weakness exists independent of other weaknesses)
+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfCategoryCategory265Privilege / Sandbox Issues
Development Concepts (primary)699
ChildOfWeakness BaseWeakness Base269Improper Privilege Management
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness Base272Least Privilege Violation
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness Base273Improper Check for Dropped Privileges
Development Concepts (primary)699
Research Concepts1000
PeerOfWeakness ClassWeakness Class250Execution with Unnecessary Privileges
Research Concepts1000
PeerOfWeakness BaseWeakness Base274Improper Handling of Insufficient Privileges
Research Concepts1000
+ Causal Nature

Explicit

+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVERPrivilege Dropping / Lowering Errors
+ Maintenance Notes

CWE-271, CWE-272, and CWE-250 are all closely related and possibly overlapping. CWE-271 is probably better suited as a category.

+ Content History
Submissions
Submission DateSubmitterOrganizationSource
PLOVERExternally Mined
Modifications
Modification DateModifierOrganizationSource
2008-07-01Eric DalciCigitalExternal
updated Time of Introduction
2008-09-08CWE Content TeamMITREInternal
updated Description, Relationships, Taxonomy Mappings, Weakness Ordinalities
2008-10-14CWE Content TeamMITREInternal
updated Description, Maintenance Notes
2009-12-28CWE Content TeamMITREInternal
updated Potential Mitigations
Back to top