Protection Mechanism Failure
Draft Pillar
Structure: Simple
Description
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
This weakness covers three distinct situations. A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack. An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended. Finally, an "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.
Common Consequences 1
Scope: Access Control
Impact: Bypass Protection Mechanism
Applicable Platforms
Languages:
Not Language-Specific : Undetermined
Technologies:
Not Technology-Specific : UndeterminedICS/OT : Undetermined
Modes of Introduction
Architecture and Design
Implementation
Operation
Related Attack Patterns
- 1DEPRECATED: Location
- 17DEPRECATED: Code
- 20Improper Input Validation
- 22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- 36Absolute Path Traversal
- 51Path Equivalence: '/multiple//internal/slash'
- 57Path Equivalence: 'fakedir/../realdir/filename'
- 59Improper Link Resolution Before File Access ('Link Following')
- 65Windows Hard Link
- 74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- 87Improper Neutralization of Alternate XSS Syntax
- 107Struts: Unused Validation Form
- 127Buffer Under-read
- 237Improper Handling of Structural Elements
- 477Use of Obsolete Function
- 480Use of Incorrect Operator
- 668Exposure of Resource to Wrong Sphere
Notes
Research GapThe concept of protection mechanisms is well established, but protection mechanism failures have not been studied comprehensively. It is suspected that protection mechanisms can have significantly different types of weaknesses than the weaknesses that they are intended to prevent.