CWE一覧に戻る
CWE-378

安全でないパーミッションでの一時ファイルの作成

Creation of Temporary File With Insecure Permissions
脆弱性 レビュー中
JA

適切な対策や制御を行わずに一時ファイルを開くと、ファイルやそのコンテンツ、そしてそのファイルが影響を与えるあらゆる機能が、攻撃に対して脆弱な状態になる可能性があります。

EN

Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.

Scope: Confidentiality / Impact: Read Application Data
Scope: Authorization, Other / Impact: Other
Scope: Integrity, Other / Impact: Other
Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.
Ensure that you use proper file permissions. This can be achieved by using a safe temp file function. Temporary files should be writable and readable only by the process that owns the file.
Randomize temporary file names. This can also be achieved by using a safe temp-file function. This will ensure that temporary files will not be created in predictable places.
MITRE公式ページ — CWE-378