COMMON WEAKNESS ENUMERATIONIncomplete

CWE-583

finalize() Method Declared Public

The product violates secure coding principles for mobile code by declaring a finalize() method public.

Soyutlama

Variant

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

The product violates secure coding principles for mobile code by declaring a finalize() method public.

Genişletilmiş açıklama

A product should never call finalize explicitly, except to call super.finalize() inside an implementation of finalize(). In mobile code situations, the otherwise error prone practice of manual garbage collection can become a security threat if an attacker can maliciously invoke a finalize() method because it is declared with public access.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Implementation

Risk

Başarılı sömürü neye yol açar?

Alter Execution LogicExecute Unauthorized Code or CommandsModify Application Data

Etkilenen güvenlik alanları: Confidentiality, Integrity, Availability

Savunma

Nasıl önlenir ve çözülür?

Implementation

Uygulama aşaması savunması

Detay
If you are using finalize() as it was designed, there is no reason to declare finalize() with anything other than protected access.

Doğrulama

Nasıl tespit edilir?

Automated Static Analysis

High
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)