Weakness (CWE)
CWE-65: Windows Hard Link
The product, when opening a file or directory, does not sufficiently handle when the name is associated with a hard link to a target that is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
How to prevent it (1 mitigation)
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Source: MITRE CWE-65
7 results · Feed
-
Medium 6.5
Windows Compressed Folder Information Disclosure Vulnerability
Windows hard link in Windows Compressed Folder allows an unauthorized attacker to disclose information over a network.
-
High 7.8
Check Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for forensics reports from a d…
-
Unscored —
ZoneAlarm Firewall and Antivirus products before version 15.8.109.18436 allow an attacker who already has access to the…
-
High 7.3CVE-2019-19231 Public exploit
An insecure file access vulnerability exists in CA Client Automation 14.0, 14.1, 14.2, and 14.3 Agent for Windows that …
-
Unscored —
A local attacker can create a hard-link between a file to which the Check Point Endpoint Security client for Windows be…
-
Unscored —CVE-2019-8452 Public exploit
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clie…
-
Unscored —
A hard-link created from the log file of Check Point ZoneAlarm up to 15.4.062 to any file on the system will get its pe…