CWE-347 密码学签名的验证不恰当
Improper Verification of Cryptographic Signature
结构: Simple
Abstraction: Base
状态: Draft
被利用可能性: unkown
基本描述
The software does not verify, or incorrectly verifies, the cryptographic signature for data.
相关缺陷
-
cwe_Nature: ChildOf cwe_CWE_ID: 345 cwe_View_ID: 1000 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 345 cwe_View_ID: 1003 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 345 cwe_View_ID: 699
适用平台
Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| ['Access Control', 'Integrity', 'Confidentiality'] | ['Gain Privileges or Assume Identity', 'Modify Application Data', 'Execute Unauthorized Code or Commands'] | An attacker could gain access to sensitive data and possibly execute unauthorized code. |
示例代码
例
In the following code, a JarFile object is created from a downloaded file.
bad Java
File f = new File(downloadedFilePath);
JarFile jf = new JarFile(f);
JarFile jf = new JarFile(f);
The JAR file that was potentially downloaded from an untrusted source is created without verifying the signature (if present). An alternate constructor that accepts a boolean verify parameter should be used instead.
分析过的案例
| 标识 | 说明 | 链接 |
|---|---|---|
| CVE-2002-1796 | Does not properly verify signatures for "trusted" entities. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1796 |
| CVE-2005-2181 | Insufficient verification allows spoofing. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2181 |
| CVE-2005-2182 | Insufficient verification allows spoofing. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2182 |
| CVE-2002-1706 | Accepts a configuration file without a Message Integrity Check (MIC) signature. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1706 |
分类映射
| 映射的分类名 | ImNode ID | Fit | Mapped Node Name |
|---|---|---|---|
| PLOVER | Improperly Verified Signature | ||
| The CERT Oracle Secure Coding Standard for Java (2011) | SEC06-J | Do not rely on the default automatic signature verification provided by URLClassLoader and java.util.jar |
相关攻击模式
- CAPEC-463
文章来源于互联网:scap中文网
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论