CWE-206 通过行为不一致性导致的内部状态信息暴露

Information Exposure of Internal State Through Behavioral Inconsistency

结构: Simple

Abstraction: Variant

状态: Incomplete

被利用可能性: unkown

基本描述

Two separate operations in a product cause the product to behave differently in a way that is observable to an attacker and reveals security-relevant information about the internal state of the product, such as whether a particular operation was successful or not.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 205 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 205 cwe_View_ID: 699 cwe_Ordinal: Primary

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围	影响	注释
['Confidentiality', 'Access Control']	['Read Application Data', 'Bypass Protection Mechanism']

可能的缓解方案

策略:

Setup generic response pages for error condition. The error page should not disclose information about the success or failure of a sensitive operation. For instance, the login page should not confirm that the login is correct and the password incorrect. The attacker who tries random account name may be able to guess some of them. Confirming that the account exists would make the login page more susceptible to brute force attack.

分析过的案例

标识	说明	链接
CVE-2002-2031	File existence via infoleak monitoring whether "onerror" handler fires or not.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2031
CVE-2005-2025	Valid groupname enumeration via behavioral infoleak (sends response if valid, doesn't respond if not).	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2025
CVE-2001-1497	Behavioral infoleak in GUI allows attackers to distinguish between alphanumeric and non-alphanumeric characters in a password, thus reducing the search space.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1497
CVE-2003-0190	Product immediately sends an error message when user does not exist instead of waiting until the password is provided, allowing username enumeration.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0190

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
PLOVER			Internal behavioral inconsistency infoleak

文章来源于互联网:scap中文网