CWE-691 Détail de la faiblesse

CWE-691

Nom

Insufficient Control Flow Management

Statut

Draft

Publié

2008-04-11
00h00 +00:00

Modifié

2025-04-03
00h00 +00:00

Liens officiels

CWE Mitre.org

Notifications pour un CWE

Restez informé de toutes modifications pour un CWE spécifique.

Gestion des notifications

Liste des Notifications

Notifications pour un CWE

Restez informé de toutes modifications pour un CWE spécifique.

Paramètres

Vous pouvez spécifier un titre qui sera récupéré dans les alertes qui seront envoyées.

Spécifiez le CWE ID que vous désirez surveiller.

Planifications

Mois

Prochaine exécution calculée

Jour

Jour de la semaine

Heure

Minute

Date de création

Dernière exécution

Prochaine exécution

Fonctionnalité nécessitant une connexion

Cette fonctionnalité qui vous permet de recevoir des alertes, n'est active que lorsque vous êtes connecté à votre compte.

Nom: Insufficient Control Flow Management

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

Informations générales

Modes d'introduction

Architecture and Design
Implementation

Plateformes applicables

Langue

Class: Not Language-Specific (Undetermined)

Technologies

Class: Not Technology-Specific (Undetermined)

Conséquences courantes

Portée	Impact	Probabilité
Other	Alter Execution Logic

Exemples observés

Références	Description
CVE-2019-9805	Chain: Creation of the packet client occurs before initialization is complete (CWE-696) resulting in a read from uninitialized memory (CWE-908), causing memory corruption.
CVE-2014-1266	chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint).
CVE-2011-1027	Chain: off-by-one error (CWE-193) leads to infinite loop (CWE-835) using invalid hex-encoded characters.

Notes de cartographie des vulnérabilités

Justification : This CWE entry is extremely high-level, a Pillar. However, classification research is limited for weaknesses of this type, so there can be gaps or organizational difficulties within CWE that force use of this weakness, even at such a high level of abstraction.
Commentaire : Where feasible, consider children or descendants of this entry instead.

Modèles d'attaque associés

CAPEC-ID	Nom du modèle d'attaque
CAPEC-29	Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.

Soumission

Nom	Organisation	Date	Date de publication	Version
CWE Content Team	MITRE	2008-04-11 +00:00	2008-04-11 +00:00	Draft 9

Modifications

Nom	Organisation	Date	Commentaire
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Relationships, Other_Notes
CWE Content Team	MITRE	2008-11-24 +00:00	updated Relationships
CWE Content Team	MITRE	2009-03-10 +00:00	updated Related_Attack_Patterns
CWE Content Team	MITRE	2009-05-27 +00:00	updated Relationships
CWE Content Team	MITRE	2010-02-16 +00:00	updated Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2010-09-27 +00:00	updated Relationships
CWE Content Team	MITRE	2010-12-13 +00:00	updated Relationships
CWE Content Team	MITRE	2011-03-29 +00:00	updated Maintenance_Notes, Other_Notes, Relationships
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Relationships
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-01-19 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Applicable_Platforms, Relationships, Relevant_Properties
CWE Content Team	MITRE	2020-02-24 +00:00	updated Applicable_Platforms, Type
CWE Content Team	MITRE	2020-06-25 +00:00	updated Relationships
CWE Content Team	MITRE	2021-03-15 +00:00	updated Maintenance_Notes
CWE Content Team	MITRE	2023-01-31 +00:00	updated Relationships
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2023-10-26 +00:00	updated Observed_Examples, Relationships
CWE Content Team	MITRE	2024-02-29 +00:00	updated Demonstrative_Examples
CWE Content Team	MITRE	2025-04-03 +00:00	updated Relationships

Détail du CWE-691