PREfast Warning 248 (Windows CE 5.0)
248 - Setting a SECURITY_DESCRIPTOR's DACL to NULL will result in an unprotected object.
Additional Information: Violates CC/C2 security requirements.
This warning identifies a call that sets the DACL field of a SECURITY_DESCRIPTOR structure to NULL.
Objects with NULL DACL fields can have security descriptors altered by malicious users so that no one has access to the object.
If an object should have open access, the object should be secured so that only administrators can alter its security.
If only the creator needs access to an object, a DACL should not be set on the object. The system will choose an appropriate default.
Example
Defective Source
RtlSetDaclSecurityDescriptor(NULL,
TRUE,
NULL,
FALSE);
Corrected Source
; // Use another method.
Send Feedback on this topic to the authors