SecPod SCAP Repo, a repository of SCAP Content (CVE, CCE, CPE, CWE, OVAL and XCCDF)

Download | Alert*

CWE

Unchecked Error Condition

ID: 391		Date: (C)2012-05-14 (M)2022-10-10
Type: weakness		Status: INCOMPLETE
Abstraction Type: Base

Description

Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.

Likelihood of Exploit: Medium

Applicable Platforms
Language Class: All

Time Of Introduction

Architecture and Design
Implementation

Common Consequences

Scope	Technical Impact	Notes
Integrity Other	Varies by context Unexpected state Alter execution logic

Detection Methods
None

Potential Mitigations

Phase	Strategy	Description	Effectiveness	Notes
Requirements		The choice between a language which has named or unnamed exceptions needs to be done. While unnamed exceptions exacerbate the chance of not properly dealing with an exception, named exceptions suffer from the up call version of the weak base class problem.
Requirements		A language can be used which requires, at compile time, to catch all serious exceptions. However, one must make sure to use the most current version of the API as new exceptions could be added.
Implementation		Catch all relevant exceptions. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.

Relationships

Related CWE	Type	View	Chain
CWE-391 ChildOf CWE-889	Category	CWE-888

Demonstrative Examples (Details)

The following code excerpt ignores a rarely-thrown exception from doExchange().

White Box Definitions
A weakness where code path has:
1. start statement that changes a state of the system resource
2. end statement that accesses the system resource, where the changed and the assumed state of the system resource are not equal.
3. the state of the resource is not compatible with the type of access being performed by the end statement

Black Box Definitions
None

Taxynomy Mappings

Taxynomy	Id	Name	Fit
PLOVER		Unchecked Return Value
7 Pernicious Kingdoms		Empty Catch Block
CLASP		Uncaught exception
OWASP Top Ten 2004	A7	Improper Error Handling	CWE_More_Specific
CERT C Secure Coding	ERR00-C	Adopt and implement a consistent and comprehensive error-handling policy
CERT C Secure Coding	FIO04-C	Detect and handle input and output errors
CERT C Secure Coding	FIO33-C	Detect and handle input output errors resulting in undefined behavior
CERT C++ Secure Coding	MEM32-CPP	Detect and handle memory allocation errors
CERT C++ Secure Coding	FIO04-CPP	Detect and handle input and output errors
CERT C++ Secure Coding	FIO33-CPP	Detect and handle input output errors resulting in undefined behavior
CERT C++ Secure Coding	ERR00-CPP	Adopt and implement a consistent and comprehensive error-handling policy
CERT C++ Secure Coding	ERR10-CPP	Check for error conditions

References:
None


30481



423868



256488



909



199193



282