CAPEC-475
Signature Spoofing by Improper Validation
Bajo
Alto
Draft
2014-06-23
00h00 +00:00
00h00 +00:00
2022-02-22
00h00 +00:00
00h00 +00:00
Alerta para un CAPEC
Manténgase informado sobre cualquier cambio en un CAPEC específico.
Descripciones CAPEC
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.
Informaciones CAPEC
Prerrequisitos
Recipient is using a weak cryptographic signature verification algorithm or a weak implementation of a cryptographic signature verification algorithm, or the configuration of the recipient's application accepts the use of keys generated using cryptographically weak signature verification algorithms.Habilidades requeridas
Cryptanalysis of signature verification algorithmReverse engineering and cryptanalysis of signature verification algorithm implementation
Mitigaciones
Use programs and products that contain cryptographic elements that have been thoroughly tested for flaws in the signature verification routines.Debilidades relacionadas
| Nombre de la debilidad | |
|---|---|
CWE-347 |
Improper Verification of Cryptographic Signature The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
CWE-327 |
Use of a Broken or Risky Cryptographic Algorithm The product uses a broken or risky cryptographic algorithm or protocol. |
CWE-295 |
Improper Certificate Validation The product does not validate, or incorrectly validates, a certificate. |
Referencias
REF-562
Microsoft's Chain of FoolsKenn White.
https://blog.lessonslearned.org/chain-of-fools/
REF-563
Patch Critical Cryptographic Vulnerability in Microsoft Windows Clients and Servershttps://media.defense.gov/2020/Jan/14/2002234275/-1/-1/0/CSA-WINDOWS-10-CRYPT-LIB-20190114.PDF
REF-564
Analysis of REF-563Thomas Ptacek, Thomas Pornin.
https://news.ycombinator.com/item?id=22048619
Envío
| Nombre | Organización | Fecha | Fecha de lanzamiento |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
Modificaciones
| Nombre | Organización | Fecha | Comentario |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Example_Instances, References, Related_Attack_Patterns, Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Example_Instances | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Example_Instances, Extended_Description |
