CWE-599 缺失对OpenSSL证书的验证
Missing Validation of OpenSSL Certificate
结构: Simple
Abstraction: Variant
状态: Incomplete
被利用可能性: unkown
基本描述
The software uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.
扩展描述
This could allow an attacker to use an invalid certificate to claim to be a trusted host, use expired certificates, or conduct other attacks that could be detected if the certificate is properly validated.
相关缺陷
-
cwe_Nature: ChildOf cwe_CWE_ID: 295 cwe_View_ID: 1000 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 295 cwe_View_ID: 699 cwe_Ordinal: Primary
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| Confidentiality | Read Application Data | The data read may not be properly secured, it might be viewed by an attacker. |
| Access Control | ['Bypass Protection Mechanism', 'Gain Privileges or Assume Identity'] | Trust afforded to the system in question may allow for spoofing or redirection attacks. |
| Access Control | Gain Privileges or Assume Identity | If the certificate is not checked, it may be possible for a redirection or spoofing attack to allow a malicious host with a valid certificate to provide data under the guise of a trusted host. While the attacker in question may have a valid certificate, it may simply be a valid certificate for a different site. In order to ensure data integrity, we must check that the certificate is valid, and that it pertains to the site we wish to access. |
可能的缓解方案
Architecture and Design
策略:
Ensure that proper authentication is included in the system design.
Implementation
策略:
Understand and properly implement all checks necessary to ensure the identity of entities involved in encrypted communications.
示例代码
例
The following OpenSSL code ensures that the host has a certificate.
bad C
// got certificate, host can be trusted
//foo=SSL_get_verify_result(ssl);
//if (X509_V_OK==foo) ...
}
Note that the code does not call SSL_get_verify_result(ssl), which effectively disables the validation step that checks the certificate.
Notes
文章来源于互联网:scap中文网
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论