Least Privilege Violation - Revision history

Imifos at 12:40, 22 January 2016

2016-01-22T12:40:12Z

Imifos at 12:45, 2 December 2015

2015-12-02T12:45:07Z

KirstenS at 01:33, 21 February 2009

2009-02-21T01:33:30Z

KirstenS at 02:39, 18 February 2009

2009-02-18T02:39:04Z

KirstenS: /* Examples */

2009-02-18T00:02:46Z

‎Examples

KirstenS at 20:57, 2 November 2008

2008-11-02T20:57:56Z

KirstenS at 14:58, 9 October 2008

2008-10-09T14:58:00Z

KirstenS at 18:04, 26 September 2008

2008-09-26T18:04:46Z

Weilin Zhong at 16:46, 19 July 2006

2006-07-19T16:46:12Z

Weilin Zhong at 14:50, 19 July 2006

2006-07-19T14:50:28Z

@@ Line 1: / Line 1: @@
 {{Template:Vulnerability}}
-Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 [[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
@@ Line 87: / Line 87: @@
 [[Category:OWASP ASDR Project]]
 [[Category:Authorization Vulnerability]]
-[[Category:OWASP C/C++ Project]]
+[[Category:C/C++]]
 [[Category:Code Snippet]]
 [[Category:Vulnerability]]

@@ Line 87: / Line 87: @@
 [[Category:OWASP ASDR Project]]
 [[Category:Authorization Vulnerability]]
-[[Category:C]]
+[[Category:OWASP C/C++ Project]]
 [[Category:Code Snippet]]
 [[Category:Vulnerability]]

@@ Line 1: / Line 1: @@
 {{Template:Vulnerability}}
 {{Template:Fortify}}
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
-[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
+[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
 ==Description==

@@ Line 1: / Line 1: @@
 {{Template:Vulnerability}}
 {{Template:Fortify}}
+<br>
 [[ASDR Table of Contents]]

← Older revision		Revision as of 00:02, 18 February 2009
Line 37:		Line 37:
	Constraining the process inside the application's home directory before opening any files is a valuable security measure. However, the absence of a call to setuid() with some non-zero value means the application is continuing to operate with unnecessary root privileges. Any successful exploit carried out by an attacker against the application can now result in a privilege escalation attack because any malicious operations will be performed with the privileges of the superuser. If the application drops to the privilege level of a non-root user, the potential for damage is substantially reduced.		Constraining the process inside the application's home directory before opening any files is a valuable security measure. However, the absence of a call to setuid() with some non-zero value means the application is continuing to operate with unnecessary root privileges. Any successful exploit carried out by an attacker against the application can now result in a privilege escalation attack because any malicious operations will be performed with the privileges of the superuser. If the application drops to the privilege level of a non-root user, the potential for damage is substantially reduced.

		+	===J2EE Misconfiguration: Weak Access Permissions===
		+	Permission to invoke EJB methods should not be granted to the ANYONE role.

		+	If the EJB deployment descriptor contains one or more method permissions that grant access to the special ANYONE role, it indicates that access control for the application has not been fully thought through or that the application is structured in such a way that reasonable access control restrictions are impossible.
		+
		+	The following deployment descriptor grants ANYONE permission to invoke the Employee EJB's method named getSalary().
		+
		+	<pre>
		+	<ejb-jar>
		+	...
		+	<assembly-descriptor>
		+	<method-permission>
		+	<role-name>ANYONE</role-name>
		+	<method>
		+	<ejb-name>Employee</ejb-name>
		+	<method-name>getSalary</method-name>
		+	</method-permission>
		+	</assembly-descriptor>
		+	...
		+	</ejb-jar>
		+	</pre>

	==Related [[Attacks]]==		==Related [[Attacks]]==

@@ Line 67: / Line 67: @@
 * [[Least privilege]]
 __NOTOC__
@@ Line 97: / Line 72: @@
 [[Category:OWASP ASDR Project]]
-[[Category:Access Control Vulnerability]]
+[[Category:Authorization Vulnerability]]
 [[Category:C]]
 [[Category:Code Snippet]]

@@ Line 2: / Line 2: @@
 {{Template:Fortify}}
-==Abstract==
+[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
 ==Description==
 When a program calls a privileged function, such as chroot(), it must first acquire root privilege. As soon as the privileged operation has completed, the program should drop root privilege and return to the privilege level of the invoking user.
 ==Examples ==
 The following code calls chroot() to restrict the application to a subset of the filesystem below APP_HOME in order to prevent an attacker from using the program to gain unauthorized access to files located elsewhere. The code then opens a file specified by the user and processes the contents of the file.
@@ Line 26: / Line 39: @@
-==Related Threats==
+==Related [[Attacks]]==
-==Related Attacks==
+* [[Attack 1]]
-*[[Broken Access Control]]
+==Related [[Vulnerabilities]]==
-==Related Countermeasures==
+* [[Broken Access Control]]
-==Categories==
+==Related [[Controls]]==
 [[Category:Access Control Vulnerability]]
 [[Category:C]]
 [[Category:Code Snippet]]

← Older revision		Revision as of 16:46, 19 July 2006
Line 1:		Line 1:
		+	{{Template:Vulnerability}}
	{{Template:Fortify}}		{{Template:Fortify}}
−	~~{{Template:Vulnerability}}~~

	==Abstract==		==Abstract==

← Older revision		Revision as of 14:50, 19 July 2006
Line 1:		Line 1:
	{{Template:Fortify}}		{{Template:Fortify}}
−
	{{Template:Vulnerability}}		{{Template:Vulnerability}}