CWE-322 未进行实体认证的密钥交换

Key Exchange without Entity Authentication

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: High

基本描述

The software performs a key exchange with an actor without verifying the identity of that actor.

扩展描述

Performing a key exchange will preserve the integrity of the information sent between two entities, but this will not guarantee that the entities are who they claim they are. This may enable a set of "man-in-the-middle" attacks. Typically, this involves a victim client that contacts a malicious server that is impersonating a trusted server. If the client skips authentication or ignores an authentication failure, the malicious server may request authentication information from the user. The malicious server can then use this authentication information to log in to the trusted server using the victim's credentials, sniff traffic between the victim and trusted server, etc.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 923 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: PeerOf cwe_CWE_ID: 295 cwe_View_ID: 1000

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

可能的缓解方案

Architecture and Design

策略:

Ensure that proper authentication is included in the system design.

Implementation

策略:

Understand and properly implement all checks necessary to ensure the identity of entities involved in encrypted communications.

示例代码

例

Many systems have used Diffie-Hellman key exchange without authenticating the entities exchanging keys, leading to man-in-the-middle attacks. Many people using SSL/TLS skip the authentication (often unknowingly).

分类映射

引用

• REF-44 24 Deadly Sins of Software Security

• REF-62 The Art of Software Security Assessment

文章来源于互联网:scap中文网