CWE-370 在初始检查后缺失对证书撤销的验证
Missing Check for Certificate Revocation after Initial Check
结构: Simple
Abstraction: Variant
状态: Draft
被利用可能性: Medium
基本描述
The software does not check the revocation status of a certificate after its initial revocation check, which can cause the software to perform privileged actions even after the certificate is revoked at a later time.
扩展描述
If the revocation status of a certificate is not checked before each action that requires privileges, the system may be subject to a race condition. If a certificate is revoked after the initial check, all subsequent actions taken with the owner of the revoked certificate will lose all benefits guaranteed by the certificate. In fact, it is almost certain that the use of a revoked certificate indicates malicious activity.
相关缺陷
-
cwe_Nature: ChildOf cwe_CWE_ID: 299 cwe_View_ID: 1000 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 299 cwe_View_ID: 699 cwe_Ordinal: Primary
-
cwe_Nature: PeerOf cwe_CWE_ID: 296 cwe_View_ID: 1000
-
cwe_Nature: PeerOf cwe_CWE_ID: 297 cwe_View_ID: 1000
-
cwe_Nature: PeerOf cwe_CWE_ID: 298 cwe_View_ID: 1000
适用平台
Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| Access Control | Gain Privileges or Assume Identity | Trust may be assigned to an entity who is not who it claims to be. |
| Integrity | Modify Application Data | Data from an untrusted (and possibly malicious) source may be integrated. |
| Confidentiality | Read Application Data | Data may be disclosed to an entity impersonating a trusted entity, resulting in information disclosure. |
可能的缓解方案
Architecture and Design
策略:
Ensure that certificates are checked for revoked status before each use of a protected resource. If the certificate is checked before each access of a protected resource, the delay subject to a possible race condition becomes almost negligible and significantly reduces the risk associated with this issue.
示例代码
例
The following code checks a certificate before performing an action.
bad C
if (X509_V_OK==foo)
//do stuff
foo=SSL_get_verify_result(ssl);
//do more stuff without the check.
While the code performs the certificate verification before each action, it does not check the result of the verification after the initial attempt. The certificate may have been revoked in the time between the privileged actions.
分类映射
| 映射的分类名 | ImNode ID | Fit | Mapped Node Name |
|---|---|---|---|
| CLASP | Race condition in checking for certificate revocation | ||
| Software Fault Patterns | SFP20 | Race Condition Window |
相关攻击模式
- CAPEC-26
- CAPEC-29
引用
文章来源于互联网:scap中文网
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论