The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).
An attacker can use an ADS to hide information about a file (e.g. size, the name of the process) from a system or file browser tools such as Windows Explorer and 'dir' at the command line utility. Alternately, the attacker might be able to bypass intended access restrictions for the associated data fork.
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| ChildOf | Allowed | B | 66 | Improper Handling of File Names that Identify Virtual Resources |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 904 | SFP Primary Cluster: Malware |
| MemberOf | Prohibited | C | 1404 | Comprehensive Categorization: File Handling |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | BS | BOSS-294 | Not Language-Specific Weaknesses |
| MemberOf | Prohibited | BS | BOSS-296 | Windows(os class) Weaknesses |
| MemberOf | Prohibited | BS | BOSS-312 | Other (impact) |
| MemberOf | Prohibited | BS | BOSS-316 | Bypass Protection Mechanism (impact) |
| MemberOf | Prohibited | BS | BOSS-322 | Hide Activities (impact) |
| Nature | Mapping | Type | ID | Name |
|---|---|---|---|---|
| MemberOf | Prohibited | C | 904 | SFP Primary Cluster: Malware |
Alternate data streams (ADS) were first implemented in the Windows NT operating system to provide compatibility between NTFS and the Macintosh Hierarchical File System (HFS). In HFS, data and resource forks are used to store information about a file. The data fork provides information about the contents of the file while the resource fork stores metadata such as file type.
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| Access ControlNon-RepudiationOther | N/A | Bypass Protection MechanismHide ActivitiesOther | N/A |
Software tools are capable of finding ADSs on your system.
Ensure that the source code correctly parses the filename to read or write to the correct stream.
N/A
| Reference | Description |
|---|---|
| CVE-1999-0278 | In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL. |
| CVE-2000-0927 | Product does not properly record file sizes if they are stored in alternative data streams, which allows users to bypass quota restrictions. |
| Ordinality | Description |
|---|
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
This and similar problems exist because the same resource can have multiple identifiers that dictate which behavior can be performed on the resource.
N/A
| Taxonomy Name | Entry ID | Fit | Entry Name |
|---|---|---|---|
| PLOVER | N/A | N/A | Windows ::DATA alternate data stream |