ByteOS Network

CWE-392:Missing Report of Error Condition

Weakness ID:392

Version:v4.17

Weakness Name:Missing Report of Error Condition

Vulnerability Mapping:Allowed

Abstraction:Base

Structure:Simple

Status:Draft

Details Content History Observed CVE Examples Reports

▼Description

The product encounters an error but does not provide a status code or return value to indicate that an error has occurred.

▼Relationships

Relevant to the view"Research Concepts - (1000)"

Nature	Mapping	Type	ID	Name
ChildOf	Discouraged	C	755	Improper Handling of Exceptional Conditions
ChildOf	Allowed-with-Review	C	684	Incorrect Provision of Specified Functionality
ParentOf	Allowed	B	1429	Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface

Nature: ChildOf

Mapping: Discouraged

Type: Class

ID: 755

Name: Improper Handling of Exceptional Conditions

Nature: ChildOf

Mapping: Allowed-with-Review

Type: Class

ID: 684

Name: Incorrect Provision of Specified Functionality

Nature: ParentOf

Mapping: Allowed

Type: Base

ID: 1429

Name: Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface

▼Memberships

Nature	Mapping	Type	ID	Name
MemberOf	Prohibited	C	389	Error Conditions, Return Values, Status Codes
MemberOf	Prohibited	C	855	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 12 - Thread Pools (TPS)
MemberOf	Prohibited	V	884	CWE Cross-section
MemberOf	Prohibited	C	961	SFP Secondary Cluster: Incorrect Exception Behavior
MemberOf	Prohibited	C	1012	Cross Cutting
MemberOf	Prohibited	C	1145	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 11. Thread Pools (TPS)
MemberOf	Prohibited	C	1412	Comprehensive Categorization: Poor Coding Practices

Nature: MemberOf

Mapping: Prohibited

Type:Category

ID: 389

Name: Error Conditions, Return Values, Status Codes

Nature: MemberOf

Mapping: Prohibited

Type:Category

ID: 855

Name: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 12 - Thread Pools (TPS)

Nature: MemberOf

Mapping: Prohibited

Type:View

ID: 884

Name: CWE Cross-section

Nature: MemberOf

Mapping: Prohibited

Type:Category

ID: 961

Name: SFP Secondary Cluster: Incorrect Exception Behavior

Nature: MemberOf

Mapping: Prohibited

Type:Category

ID: 1012

Name: Cross Cutting

Nature: MemberOf

Mapping: Prohibited

Type:Category

ID: 1145

Name: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 11. Thread Pools (TPS)

Nature: MemberOf

Mapping: Prohibited

Type:Category

ID: 1412

Name: Comprehensive Categorization: Poor Coding Practices

▼Tags

Nature	Mapping	Type	ID	Name
MemberOf	Prohibited	BS	BOSS-294	Not Language-Specific Weaknesses
MemberOf	Prohibited	BS	BOSS-315	Unexpected State (impact)
MemberOf	Prohibited	BS	BOSS-326	Varies by Context (impact)

Nature: MemberOf

Mapping: Prohibited

Type:BOSSView

ID: BOSS-294

Name: Not Language-Specific Weaknesses

Nature: MemberOf

Mapping: Prohibited

Type:BOSSView

ID: BOSS-315

Name: Unexpected State (impact)

Nature: MemberOf

Mapping: Prohibited

Type:BOSSView

ID: BOSS-326

Name: Varies by Context (impact)

▼Relevant To View

Relevant to the view"Architectural Concepts - (1008)"

Nature	Mapping	Type	ID	Name
MemberOf	Prohibited	C	1012	Cross Cutting

Nature: MemberOf

Mapping: Prohibited

Type: Category

ID: 1012

Name: Cross Cutting

Relevant to the view"Weaknesses Addressed by the SEI CERT Oracle Coding Standard for Java - (1133)"

Nature	Mapping	Type	ID	Name
MemberOf	Prohibited	C	1145	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 11. Thread Pools (TPS)

Nature: MemberOf

Mapping: Prohibited

Type: Category

ID: 1145

Name: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 11. Thread Pools (TPS)

Relevant to the view"Software Development - (699)"

Nature	Mapping	Type	ID	Name
MemberOf	Prohibited	C	389	Error Conditions, Return Values, Status Codes

Nature: MemberOf

Mapping: Prohibited

Type: Category

ID: 389

Name: Error Conditions, Return Values, Status Codes

Relevant to the view"Software Fault Pattern (SFP) Clusters - (888)"

Nature	Mapping	Type	ID	Name
MemberOf	Prohibited	C	961	SFP Secondary Cluster: Incorrect Exception Behavior

Nature: MemberOf

Mapping: Prohibited

Type: Category

ID: 961

Name: SFP Secondary Cluster: Incorrect Exception Behavior

▼Common Consequences

Scope	Likelihood	Impact	Note
IntegrityOther	N/A	Varies by ContextUnexpected State	Errors that are not properly reported could place the system in an unexpected state that could lead to unintended behaviors.

Scope: Integrity, Other

Likelihood: N/A

Impact: Varies by Context, Unexpected State

Note:

Errors that are not properly reported could place the system in an unexpected state that could lead to unintended behaviors.

▼Modes Of Introduction

Phase: Implementation

Note:

N/A

▼Applicable Platforms

Languages

Class: Not Language-Specific(Undetermined Prevalence)

▼Demonstrative Examples

Example 1

In the following snippet from a doPost() servlet method, the server returns "200 OK" (default) even if an error occurs.

Language: Java(Bad code)

try { // Something that may throw an exception.* ...} catch (Throwable t) { logger.error("Caught: " + t.toString()); return; }

▼Observed Examples

Reference	Description
[REF-1374]	Chain: JavaScript-based cryptocurrency library can fall back to the insecure Math.random() function instead of reporting a failure (CWE-392), thus reducing the entropy (CWE-332) and leading to generation of non-unique cryptographic keys for Bitcoin wallets (CWE-1391)
CVE-2004-0063	Function returns "OK" even if another function returns a different status code than expected, leading to accepting an invalid PIN number.
CVE-2002-1446	Error checking routine in PKCS#11 library returns "OK" status even when invalid signature is detected, allowing spoofed messages.
CVE-2002-0499	Kernel function truncates long pathnames without generating an error, leading to operation on wrong directory.
CVE-2005-2459	Function returns non-error value when a particular erroneous condition is encountered, leading to resultant NULL dereference.

Reference: [REF-1374]

Description:

Chain: JavaScript-based cryptocurrency library can fall back to the insecure Math.random() function instead of reporting a failure (CWE-392), thus reducing the entropy (CWE-332) and leading to generation of non-unique cryptographic keys for Bitcoin wallets (CWE-1391)

Reference: CVE-2004-0063

Description:

Function returns "OK" even if another function returns a different status code than expected, leading to accepting an invalid PIN number.

Reference: CVE-2002-1446

Description:

Error checking routine in PKCS#11 library returns "OK" status even when invalid signature is detected, allowing spoofed messages.

Reference: CVE-2002-0499

Description:

Kernel function truncates long pathnames without generating an error, leading to operation on wrong directory.

Reference: CVE-2005-2459

Description:

Function returns non-error value when a particular erroneous condition is encountered, leading to resultant NULL dereference.

▼Weakness Ordinalities

Ordinality	Description
Primary	N/A
Resultant	N/A

Ordinality: Primary

Description:

N/A

Ordinality: Resultant

Description:

N/A

▼Vulnerability Mapping Notes

Usage:Allowed

Reason:Acceptable-Use

Rationale:

This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Comments:

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

▼Taxonomy Mappings

Taxonomy Name	Entry ID	Fit	Entry Name
PLOVER	N/A	N/A	Missing Error Status Code
The CERT Oracle Secure Coding Standard for Java (2011)	TPS03-J	N/A	Ensure that tasks executing in a thread pool do not fail silently
Software Fault Patterns	SFP6	N/A	Incorrect Exception Behavior

Taxonomy Name: PLOVER

Entry ID: N/A

Fit: N/A

Entry Name: Missing Error Status Code

Taxonomy Name: The CERT Oracle Secure Coding Standard for Java (2011)

Entry ID: TPS03-J

Fit: N/A

Entry Name: Ensure that tasks executing in a thread pool do not fail silently

Taxonomy Name: Software Fault Patterns

Entry ID: SFP6

Fit: N/A

Entry Name: Incorrect Exception Behavior

▼References

Reference ID: REF-1374

Title: Randstorm: You Can't Patch a House of Cards

Author: Unciphered

Publication:

URL:https://www.unciphered.com/blog/randstorm-you-cant-patch-a-house-of-cards

URL Date:2023-11-15

Day:14

Month:11

Year:2023