導入モード
Implementation
適用可能なプラットフォーム
言語
クラス： Not Language-Specific (Undetermined)
一般的な結果
| スコープ |
影響 |
可能性 |
| Other | Reduce Reliability | |
| Other | Reduce Performance | |
観察された例
| 参考文献 |
説明 |
| Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint). The code's whitespace indentation did not reflect the actual control flow (CWE-1114) and did not explicitly delimit the block (CWE-483), which could have made it more difficult for human code auditors to detect the vulnerability. |
検出方法
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
脆弱性マッピングノート
理由 : This CWE entry is a Class and might have Base-level children that would be more appropriate
コメント : Examine children of this entry to see if there is a better fit
登録情報
| 名前 |
組織 |
日付 |
リリース日 |
Version |
| CWE Content Team |
MITRE |
2019-01-02 +00:00 |
2019-01-03 +00:00 |
3.2 |
変更履歴
| 名前 |
組織 |
日付 |
コメント |
| CWE Content Team |
MITRE |
2020-02-24 +00:00 |
updated Relationships |
| CWE Content Team |
MITRE |
2022-04-28 +00:00 |
updated Relationships |
| CWE Content Team |
MITRE |
2023-01-31 +00:00 |
updated Description |
| CWE Content Team |
MITRE |
2023-04-27 +00:00 |
updated Relationships |
| CWE Content Team |
MITRE |
2023-06-29 +00:00 |
updated Mapping_Notes |
| CWE Content Team |
MITRE |
2023-10-26 +00:00 |
updated Observed_Examples |
| CWE Content Team |
MITRE |
2024-02-29 +00:00 |
updated Demonstrative_Examples |
| CWE Content Team |
MITRE |
2025-12-11 +00:00 |
updated Applicable_Platforms, Detection_Factors, Observed_Examples, Time_of_Introduction, Weakness_Ordinalities |
| CWE Content Team |
MITRE |
2026-10-28 +00:00 |
updated Description, Relationships, Technical_Nuance |
