日本語

CAPEC-75

Manipulating Writeable Configuration Files
2014-06-23
00h00 +00:00
高
Draft
2022-09-29
00h00 +00:00
CAPEC Mitre.org
特定のCAPECのアラート
特定のCAPECの変更情報をいち早くお届けします。
通知を管理する

CAPEC の説明

Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.

CAPEC の情報

前提条件

Configuration files must be modifiable by the attacker

必要なスキル

To identify vulnerable configuration files, and understand how to manipulate servers and erase forensic evidence

緩和策

Design: Enforce principle of least privilege
Design: Backup copies of all configuration files
Implementation: Integrity monitoring for configuration files
Implementation: Enforce audit logging on code and configuration promotion procedures.
Implementation: Load configuration from separate process and memory space, for example a separate physical device like a CD

関連する弱点

CWE-ID 弱点名

CWE-349

 Acceptance of Extraneous Untrusted Data With Trusted Data
The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.

CWE-99

 Improper Control of Resource Identifiers
The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended control sphere.

CWE-77

 Improper Neutralization of Special Elements used in a Command
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

CWE-346

 Origin Validation Error
The product does not properly verify that the source of data or communication is valid.

CWE-353

 Missing Support for Integrity Check
The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

CWE-354

 Improper Validation of Integrity Check Value
The product does not validate or incorrectly validates the integrity check values or "checksums" of a message.

参考文献

REF-1

Exploiting Software: How to Break Code
G. Hoglund, G. McGraw.

登録情報

名前 組織 日付 リリース日
CAPEC Content Team The MITRE Corporation 2014-06-23 +00:00

変更履歴

名前 組織 日付 コメント
CAPEC Content Team The MITRE Corporation 2015-12-07 +00:00 Updated Related_Attack_Patterns
CAPEC Content Team The MITRE Corporation 2019-09-30 +00:00 Updated Related_Attack_Patterns
CAPEC Content Team The MITRE Corporation 2020-07-30 +00:00 Updated Related_Attack_Patterns
CAPEC Content Team The MITRE Corporation 2021-06-24 +00:00 Updated Related_Weaknesses
CAPEC Content Team The MITRE Corporation 2022-09-29 +00:00 Updated Example_Instances
CVE Findに掲載されている情報は、慎重に選定された複数の参照ソースから取得されています。CVEデータはMITRE Corporationおよび国家脆弱性データベース（NVD）が提供しています。既知の悪用された脆弱性（KEV）カタログはサイバーセキュリティ・インフラセキュリティ庁（CISA）から、EPSSスコアはFIRST.orgから取得しています。また、ソフトウェアの弱点（CWE）および共通攻撃パターン（CAPEC）に関するデータはMITRE Corporationが管理し、ハードウェアおよびソフトウェア構成（CPE）に関する情報はNVDが提供しています。