日本語

CAPEC-477

Signature Spoofing by Mixing Signed and Unsigned Content
2014-06-23
00h00 +00:00
低
高
Draft
CAPEC Mitre.org
特定のCAPECのアラート
特定のCAPECの変更情報をいち早くお届けします。
通知を管理する

CAPEC の説明

An attacker exploits the underlying complexity of a data structure that allows for both signed and unsigned content, to cause unsigned data to be processed as though it were signed data.

CAPEC の情報

前提条件

Signer and recipient are using complex data storage structures that allow for a mix between signed and unsigned data
Recipient is using signature verification software that does not maintain separation between signed and unsigned data once the signature has been verified.

必要なスキル

The attacker may need to continuously monitor a stream of signed data, waiting for an exploitable message to appear.
Attacker must be able to create malformed data blobs and know how to insert them in a location that the recipient will visit.

緩和策

Ensure the application is fully patched and does not allow the processing of unsigned data as if it is signed data.

関連する弱点

CWE-ID 弱点名

CWE-693

 Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

CWE-311

 Missing Encryption of Sensitive Data
The product does not encrypt sensitive or critical information before storage or transmission.

CWE-319

 Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

登録情報

名前 組織 日付 リリース日
CAPEC Content Team The MITRE Corporation 2014-06-23 +00:00
CVE Findに掲載されている情報は、慎重に選定された複数の参照ソースから取得されています。CVEデータはMITRE Corporationおよび国家脆弱性データベース（NVD）が提供しています。既知の悪用された脆弱性（KEV）カタログはサイバーセキュリティ・インフラセキュリティ庁（CISA）から、EPSSスコアはFIRST.orgから取得しています。また、ソフトウェアの弱点（CWE）および共通攻撃パターン（CAPEC）に関するデータはMITRE Corporationが管理し、ハードウェアおよびソフトウェア構成（CPE）に関する情報はNVDが提供しています。