Improper error handling
This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.
Last revision (mm/dd/yy): 02/24/2009
Vulnerabilities Table of Contents
Description
Sometimes an error is detected, and bad or no action is taken.
Consequences
Undefined.
Exposure period
Implementation: This is generally a logical flaw or a typo introduced completely at implementation time.
Platform
Languages: All
Operating platforms: All
Required resources
Any
Severity
Medium
Likelihood of exploit
Medium
If a function returns an error, it is important to either fix the problem and try again, alert the user that an error has happened and let the program continue, or alert the user and close and cleanup the program.
Risk Factors
TBD
Examples
In C:
foo=malloc(sizeof(char);
//the next line checks to see if malloc failed
if (foo==0) {
//We do nothing so we just ignore the error.
}
In C++ and Java:
while (DoSomething()) {
try {
/* perform main loop here */
}
catch (Exception &e){
/* do nothing, but catch so it'll compile... */
}
}
Related Attacks
Related Vulnerabilities
Related Controls
- Implementation: Properly handle each exception. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.
Related Technical Impacts
References
TBD
