Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Official definition

ByMitre CWE

During installation, installed file permissions are set to allow anyone to modify those files.

Characteristics

Modes of introduction

Architecture and Design
Implementation
Installation
Operation

Common consequences

Impact	Scope	Explanation
Read Application Data, Modify Application Data	Confidentiality, Integrity	—

Risk mitigations

Architecture and Design, OperationThe architecture needs to access and modification attributes for files to only those users who actually require those actions.
Separation of Privilege · Architecture and DesignCompartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Detection methods

Method	Approach	Effectiveness
Automated Static Analysis - Binary or Bytecode	According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Inter-application Flow Analysis	SOAR Partial
Manual Static Analysis - Binary or Bytecode	According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies	SOAR Partial
Dynamic Analysis with Automated Results Interpretation	According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Host-based Vulnerability Scanners - Examine configuration for flaws, verifying that audit mechanisms work, ensure host configuration meets certain predefined criteria Web Application Scanner Web Services Scanner Database Scanners	SOAR Partial
Dynamic Analysis with Manual Results Interpretation	According to SOAR [REF-1479], the following detection techniques may be useful: ``` Highly cost effective: ``` Host Application Interface Scanner ``` Cost effective for partial coverage: ``` Fuzz Tester Framework-based Fuzzer Automated Monitored Execution Forced Path Execution	High
Manual Static Analysis - Source Code	According to SOAR [REF-1479], the following detection techniques may be useful: ``` Highly cost effective: ``` Manual Source Code Review (not inspections) ``` Cost effective for partial coverage: ``` Focused Manual Spotcheck - Focused manual analysis of source	High
Automated Static Analysis - Source Code	According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Context-configured Source Code Weakness Analyzer	SOAR Partial
Automated Static Analysis	According to SOAR [REF-1479], the following detection techniques may be useful: ``` Cost effective for partial coverage: ``` Configuration Checker	SOAR Partial
Architecture or Design Review	According to SOAR [REF-1479], the following detection techniques may be useful: ``` Highly cost effective: ``` Formal Methods / Correct-By-Construction ``` Cost effective for partial coverage: ``` Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)	High

Representative vulnerabilities

Below are representative vulnerabilities related to this CWE, prioritized by severity.

Sources (3)

MITRE CWE

CWE Terms of Use

ida.org

CWE-276: Incorrect Default Permissions

What is CWE-276?

Data statistics

Vulnerabilities mapped to CWE-276

Vulnerabilities in CISA KEV for CWE-276