CWE-206 通过行为不一致性导致的内部状态信息暴露
Information Exposure of Internal State Through Behavioral Inconsistency
结构: Simple
Abstraction: Variant
状态: Incomplete
被利用可能性: unkown
基本描述
Two separate operations in a product cause the product to behave differently in a way that is observable to an attacker and reveals security-relevant information about the internal state of the product, such as whether a particular operation was successful or not.
相关缺陷
-
cwe_Nature: ChildOf cwe_CWE_ID: 205 cwe_View_ID: 1000 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 205 cwe_View_ID: 699 cwe_Ordinal: Primary
适用平台
Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}
常见的影响
范围 | 影响 | 注释 |
---|---|---|
['Confidentiality', 'Access Control'] | ['Read Application Data', 'Bypass Protection Mechanism'] |
可能的缓解方案
策略:
Setup generic response pages for error condition. The error page should not disclose information about the success or failure of a sensitive operation. For instance, the login page should not confirm that the login is correct and the password incorrect. The attacker who tries random account name may be able to guess some of them. Confirming that the account exists would make the login page more susceptible to brute force attack.
分析过的案例
标识 | 说明 | 链接 |
---|---|---|
CVE-2002-2031 | File existence via infoleak monitoring whether "onerror" handler fires or not. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2031 |
CVE-2005-2025 | Valid groupname enumeration via behavioral infoleak (sends response if valid, doesn't respond if not). | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2025 |
CVE-2001-1497 | Behavioral infoleak in GUI allows attackers to distinguish between alphanumeric and non-alphanumeric characters in a password, thus reducing the search space. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1497 |
CVE-2003-0190 | Product immediately sends an error message when user does not exist instead of waiting until the password is provided, allowing username enumeration. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0190 |
分类映射
映射的分类名 | ImNode ID | Fit | Mapped Node Name |
---|---|---|---|
PLOVER | Internal behavioral inconsistency infoleak |
文章来源于互联网:scap中文网
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论