Privilege Context Switching Error
Weakness ID: 270 (Weakness Base)Status: Draft
+ Description

Description Summary

The software does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control.
+ Time of Introduction
  • Architecture and Design
  • Implementation
  • Operation
+ Applicable Platforms

Languages

All

+ Observed Examples
ReferenceDescription
CVE-2002-1688Web browser cross domain problem when user hits "back" button.
CVE-2003-1026Web browser cross domain problem when user hits "back" button.
CVE-2002-1770Cross-domain issue - third party product passes code to web browser, which executes it in unsafe zone.
CVE-2005-2263Run callback in different security context after it has been changed from untrusted to trusted. * note that "context switch before actions are completed" is one type of problem that happens frequently, espec. in browsers.
+ Potential Mitigations

Very carefully manage the setting, management and handling of privileges. Explicitly manage trust zones in the software.

Follow the principle of least privilege when assigning access rights to entities in a software system.

Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness BaseWeakness Base269Improper Privilege Management
Development Concepts (primary)699
Research Concepts (primary)1000
+ Research Gaps

This concept needs more study.

+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVERPrivilege Context Switching Error
+ Related Attack Patterns
CAPEC-IDAttack Pattern Name
(CAPEC Version: 1.4)
17Accessing, Modifying or Executing Executable Files
30Hijacking a Privileged Thread of Execution
35Leverage Executable Code in Nonexecutable Files
+ References
[REF-11] M. Howard and D. LeBlanc. "Writing Secure Code". Chapter 7, "Running with Least Privilege" Page 207. 2nd Edition. Microsoft. 2002.
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
PLOVERExternally Mined
Modifications
Modification DateModifierOrganizationSource
2008-07-01Eric DalciCigitalExternal
updated Time of Introduction
2008-09-08CWE Content TeamMITREInternal
updated Description, Relationships, Taxonomy Mappings
2009-12-28CWE Content TeamMITREInternal
updated Potential Mitigations
Back to top