Enterprise Library Test Guide - Willy .Net

Testing for Security Best Practices 141
Threat 11
STRIDE
classification
Risk
Mitigation
Investigative notes
Altering the log file’s directory path in the configuration file
Tampering, Denial of Services, Elevation of Privileges
High
No
None
Table 28 lists the DREAD rating for threat 11.
Table 28: Threat 11 DREAD Rating
D R E A D Total Rating
3 3 2 3 3 14 High
Table 29 lists details about threat 12.
Table 29: Logging Application Block Threat 12
Threat 12
Name
Entry points
Threat
description
Countermeasures
STRIDE
classification
Risk
Mitigation
Investigative
notes
The Debug.Assert statements can cause a denial of service when the
application is in debug mode
Debug.Assert statements halt code while in debug mode
Public classes and static methods
The LogEntry public class has a static method named GetProcessName.
The method uses the NativeMethods class to retrieve the name of the
current process. (The NativeMethods class calls unmanaged APIs.) If an exception
is thrown inside a call to unmanaged code and the process name is
not properly returned, the Debug.Assert statement displays a message box.
This message box requires a user to select Abort, Retry, or Ignore before
the application can proceed. This can constitute a denial of service attack
in the case of service applications.
Remove all Debug.Assert statements from the Logging Application Block
code before it is shipped.
Denial of Services
High
No
The following code shows an example of a Debug.Assert statement that
should be removed.
public static string GetProcessName()
{
StringBuilder buffer = new StringBuilder(1024);
int length = NativeMethods.GetModuleFileName(NativeMethods
.GetModuleHandle(null), buffer, buffer.Capacity);
Debug.Assert(length > 0);
//This line can halt the code when in debug mode.
return buffer.ToString();
}