CWE-422 未保护的Windows消息通道（Shatter）
Unprotected Windows Messaging Channel ('Shatter')
结构: Simple
Abstraction: Variant
状态: Draft
被利用可能性: unkown
基本描述
The software does not properly verify the source of a message in the Windows Messaging System while running at elevated privileges, creating an alternate channel through which an attacker can directly send a message to the product.
相关缺陷
-
cwe_Nature: ChildOf cwe_CWE_ID: 420 cwe_View_ID: 1000 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 420 cwe_View_ID: 699 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 360 cwe_View_ID: 1000
适用平台
Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| Access Control | ['Gain Privileges or Assume Identity', 'Bypass Protection Mechanism'] |
可能的缓解方案
Architecture and Design
策略:
Always verify and authenticate the source of the message.
分析过的案例
| 标识 | 说明 | 链接 |
|---|---|---|
| CVE-2002-0971 | Bypass GUI and access restricted dialog box. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0971 |
| CVE-2002-1230 | Gain privileges via Windows message. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1230 |
| CVE-2003-0350 | A control allows a change to a pointer for a callback function using Windows message. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0350 |
| CVE-2003-0908 | Product launches Help functionality while running with raised privileges, allowing command execution using Windows message to access "open file" dialog. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0908 |
| CVE-2004-0213 | Attacker uses Shatter attack to bypass GUI-enforced protection for CVE-2003-0908. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0213 |
| CVE-2004-0207 | User can call certain API functions to modify certain properties of privileged programs. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0207 |
Notes
Relationship
Overlaps privilege errors and UI errors.
Research Gap
分类映射
| 映射的分类名 | ImNode ID | Fit | Mapped Node Name |
|---|---|---|---|
| PLOVER | Unprotected Windows Messaging Channel ('Shatter') | ||
| Software Fault Patterns | SFP30 | Missing endpoint authentication |
引用
-
REF-402 Exploiting design flaws in the Win32 API for privilege escalation. Or... Shatter Attacks - How to break Windows
文章来源于互联网:scap中文网
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论