CWE-599 缺失对OpenSSL证书的验证

admin 2021年11月4日23:16:33评论51 views字数 1809阅读6分1秒阅读模式

CWE-599 缺失对OpenSSL证书的验证

Missing Validation of OpenSSL Certificate

结构: Simple

Abstraction: Variant

状态: Incomplete

被利用可能性: unkown

基本描述

The software uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.

扩展描述

This could allow an attacker to use an invalid certificate to claim to be a trusted host, use expired certificates, or conduct other attacks that could be detected if the certificate is properly validated.

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 295 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 295 cwe_View_ID: 699 cwe_Ordinal: Primary

常见的影响

范围 影响 注释
Confidentiality Read Application Data The data read may not be properly secured, it might be viewed by an attacker.
Access Control ['Bypass Protection Mechanism', 'Gain Privileges or Assume Identity'] Trust afforded to the system in question may allow for spoofing or redirection attacks.
Access Control Gain Privileges or Assume Identity If the certificate is not checked, it may be possible for a redirection or spoofing attack to allow a malicious host with a valid certificate to provide data under the guise of a trusted host. While the attacker in question may have a valid certificate, it may simply be a valid certificate for a different site. In order to ensure data integrity, we must check that the certificate is valid, and that it pertains to the site we wish to access.

可能的缓解方案

Architecture and Design

策略:

Ensure that proper authentication is included in the system design.

Implementation

策略:

Understand and properly implement all checks necessary to ensure the identity of entities involved in encrypted communications.

示例代码

The following OpenSSL code ensures that the host has a certificate.

bad C

if (cert = SSL_get_peer_certificate(ssl)) {


// got certificate, host can be trusted

//foo=SSL_get_verify_result(ssl);

//if (X509_V_OK==foo) ...

}

Note that the code does not call SSL_get_verify_result(ssl), which effectively disables the validation step that checks the certificate.

Notes

文章来源于互联网:scap中文网

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2021年11月4日23:16:33
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   CWE-599 缺失对OpenSSL证书的验证http://cn-sec.com/archives/613087.html

发表评论

匿名网友 填写信息