CWE-69

Variant Abstraction Level
Pillar — Highest-level weakness category
Class — Abstract, language-independent
Base — Specific enough to detect
Variant — Tied to specific technology
Compound — Requires multiple weaknesses Incomplete MITRE CWE Status
Stable — Fully reviewed and complete
Draft — Under development, may change
Incomplete — Partially defined by MITRE
Deprecated — No longer recommended
Obsolete — Replaced by another CWE
Improper Handling of Windows ::DATA Alternate Data Stream

Description

The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).

An attacker can use an ADS to hide information about a file (e.g. size, the name of the process) from a system or file browser tools such as Windows Explorer and 'dir' at the command line utility. Alternately, the attacker might be able to bypass intended access restrictions for the associated data fork.

Consequences

Access Control, Non-Repudiation, Other — Bypass Protection Mechanism, Hide Activities, Other

Mitigations

Phase: Implementation

Ensure that the source code correctly parses the filename to read or write to the correct stream.

Detection

Automated Analysis

Software tools are capable of finding ADSs on your system.