CWE-459: Incomplete Cleanup

Description

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Potential Impact

Other, Confidentiality, Integrity

Other, Read Application Data, Modify Application Data, DoS: Resource Consumption (Other)

Demonstrative Examples

Stream resources in a Java application should be released in a finally block, otherwise an exception thrown before the call to close() would result in an unreleased I/O resource. In the example below, the close() method is called in the try block (incorrect).

Bad

try {InputStream is = new FileInputStream(path);byte b[] = new byte[is.available()];is.read(b);is.close();} catch (Throwable t) {log.error("Something bad happened: " + t.getMessage());}

Mitigations & Prevention

Architecture and DesignImplementation

Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.

Detection Methods

Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea

Real-World CVE Examples

CVE ID	Description
CVE-2000-0552	World-readable temporary file not deleted after use.
CVE-2005-2293	Temporary file not deleted after use, leaking database usernames and passwords.
CVE-2002-0788	Interaction error creates a temporary file that can not be deleted due to strong permissions.
CVE-2002-2066	Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
CVE-2002-2067	Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
CVE-2002-2068	Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
CVE-2002-2069	Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
CVE-2002-2070	Alternate data streams for NTFS files are not cleared when files are wiped (alternate channel / infoleak).
CVE-2005-1744	Users not logged out when application is restarted after security-relevant changes were made.

Taxonomy Mappings

PLOVER: — Incomplete Cleanup
OWASP Top Ten 2004: A10 — Insecure Configuration Management
CERT C Secure Coding: FIO42-C — Close files when they are no longer needed
CERT C Secure Coding: MEM31-C — Free dynamically allocated memory when no longer needed
The CERT Oracle Secure Coding Standard for Java (2011): FIO04-J — Release resources when they are no longer needed
The CERT Oracle Secure Coding Standard for Java (2011): FIO00-J — Do not operate on files in shared directories
Software Fault Patterns: SFP14 — Failure to release resource

Frequently Asked Questions

What is CWE-459?

CWE-459 (Incomplete Cleanup) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

How can CWE-459 be exploited?

Attackers can exploit CWE-459 (Incomplete Cleanup) to other, read application data, modify application data, dos: resource consumption (other). This weakness is typically introduced during the Implementation phase of software development.

How do I prevent CWE-459?

Key mitigations include: Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.

What is the severity of CWE-459?

CWE-459 is classified as a Base-level weakness (Medium abstraction). It has been observed in 9 real-world CVEs.