Difference between revisions of "Improper error handling"

From OWASP
Jump to: navigation, search
Line 2: Line 2:
 
{{Template:Vulnerability}}
 
{{Template:Vulnerability}}
  
[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
+
__TOC__
 +
 
 +
[[ASDR Table of Contents]]
  
 
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
  
[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
 
  
[[ASDR Table of Contents]]
+
[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
__TOC__
+
  
  

Revision as of 08:41, 2 November 2008

This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.


Contents


ASDR Table of Contents

Last revision (mm/dd/yy): 11/2/2008


Description

Sometimes an error is detected, and bad or no action is taken.

Consequences

Undefined.

Exposure period

Implementation: This is generally a logical flaw or a typo introduced completely at implementation time.

Platform

Languages: All

Operating platforms: All

Required resources

Any

Severity

Medium

Likelihood of exploit

Medium

If a function returns an error, it is important to either fix the problem and try again, alert the user that an error has happened and let the program continue, or alert the user and close and cleanup the program.


Risk Factors

TBD

Examples

In C:

foo=malloc(sizeof(char);
//the next line checks to see if malloc failed
if (foo==0) {
//We do nothing so we just ignore the error.
}

In C++ and Java:

while (DoSomething()) {
  try {
    /* perform main loop here */
  }
  catch (Exception &e){
    /* do nothing, but catch so it'll compile... */
  }
}


Related Attacks


Related Vulnerabilities


Related Controls

  • Implementation: Properly handle each exception. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.

Related Technical Impacts


References

TBD