Unchecked Return Values Vulnerability in CA 2E

Products

• CA 2E

Issue/Introduction

During a vulnerability scan of a 2E environment the test results show a vulnerability for unchecked return value similar identified as:

CWE-252 Unchecked Return Value

The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

The unchecked return values are found in built in programs like:

• Y2CLMSC
• Y2SNMGC
• YDDSHPR
• Y2CPMSC
• Y2RCRSC
• Y2RTJCR
• Y2QLVNR

This article advises users how to handle these vulnerabilities and explains the logic behind these suggestions.

 

Environment

Source Code generated in RPG and RP4

All versions of CA 2E

Resolution

After internal investigation into these programs, the Development team has found that CA 2E is NOT VULNERABLE to the unchecked return values vulnerability. 

The above programs are designed for one specific purpose alone and accomplish this purpose. 

They are not used during design time in the Action Diagram and are instead runtime objects which are needed for proper execution of the generated programs.

As a result, there is no Action Diagram control or processing associated with these programs. 

CWE-252 catches cases where ignoring a failure signal lets a program continue running on corrupted, stale, or attacker influenced states 

Example: A C program that ignores a failed malloc()/read() and then derefences invalid memory or trusts bad data.

In most cases the inputs to the program are also standard and the code flow follows a standard path. 

Error handling is built in to handle logic flow inside the program and provide the necessary output.

Code generators are also tailored to ensure proper inputs are sent to these programs.

Programs utilize their own message queue, job attributes, previously validated file/library name, or help text to operate.

None of these items accept unvalidated external input that could lead to injection, auth bypass, or data exposure. 

No attacker controlled data flows through the unchecked path unless the generated code is manually modified intentionally.

Given this information, we believe that the product is working as designed and the scenarios related to CWE-252 do not occur in these programs.

We advise users to mark these vulnerabilities as false positives or mitigated by design.