名前: Violation of Secure Design Principles

The product violates well-established principles for secure design.

一般情報

導入モード

Architecture and Design

適用可能なプラットフォーム

言語

クラス： Not Language-Specific (Undetermined)

オペレーティングシステム

クラス： Not OS-Specific (Undetermined)

テクノロジー

クラス： Not Technology-Specific (Undetermined)

一般的な結果

スコープ	影響	可能性
Other	Varies by Context 注記：This can introduce resultant weaknesses or make it easier for developers to introduce related weaknesses during implementation.
Other	Reduce Maintainability 注記：Because code is centered around design, it can be resource-intensive to fix design problems.

観察された例

参考文献	説明
CVE-2019-6260	Baseboard Management Controller (BMC) device implements Advanced High-performance Bus (AHB) bridges that do not require authentication for arbitrary read and write access to the BMC's physical address space from the host, and possibly the network [REF-1138].
CVE-2007-5277	The failure of connection attempts in a web browser resets DNS pin restrictions. An attacker can then bypass the same origin policy by rebinding a domain name to a different IP address. This was an attempt to "fail functional."
CVE-2006-7142	Hard-coded cryptographic key stored in executable program.
CVE-2007-0408	Server does not properly validate client certificates when reusing cached connections.

脆弱性マッピングノート

理由 : This CWE entry is a level-1 Class (i.e., a child of a Pillar). It might have lower-level children that would be more appropriate
コメント : Examine children of this entry to see if there is a better fit

参考文献

REF-196

The Protection of Information in Computer Systems
Jerome H. Saltzer, Michael D. Schroeder.
http://web.mit.edu/Saltzer/www/publications/protection/

REF-546

Design Principles
Sean Barnum, Michael Gegick.
https://web.archive.org/web/20220126060046/https://www.cisa.gov/uscert/bsi/articles/knowledge/principles/design-principles

REF-542

RFC: 793, TRANSMISSION CONTROL PROTOCOL
Jon Postel, Editor.
https://www.ietf.org/rfc/rfc793.txt

REF-1138

CVE-2019-6260: Gaining control of BMC from the host processor
Stewart Smith.
https://www.flamingspork.com/blog/2019/01/23/cve-2019-6260:-gaining-control-of-bmc-from-the-host-processor/

REF-1314

ICS Alert (ICS-ALERT-20-063-01): SweynTooth Vulnerabilities
ICS-CERT.
https://www.cisa.gov/news-events/ics-alerts/ics-alert-20-063-01

REF-1315

Unleashing Mayhem over Bluetooth Low Energy
Matheus E. Garbelini, Sudipta Chattopadhyay, Chundong Wang, Singapore University of Technology and Design.
https://asset-group.github.io/disclosures/sweyntooth/

登録情報

名前	組織	日付	リリース日	Version
CWE Community		2008-01-30 +00:00	2008-01-30 +00:00	Draft 8

変更履歴

名前	組織	日付	コメント
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Description, Relationships
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated Relationships
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-01-19 +00:00	updated Relationships
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2021-10-28 +00:00	updated Relationships
CWE Content Team	MITRE	2022-10-13 +00:00	updated References
CWE Content Team	MITRE	2023-01-31 +00:00	updated Maintenance_Notes, Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2023-04-27 +00:00	updated References, Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2023-10-26 +00:00	updated Demonstrative_Examples, Observed_Examples, References
CWE Content Team	MITRE	2024-02-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-09-09 +00:00	updated Demonstrative_Examples, References
CWE Content Team	MITRE	2025-12-11 +00:00	updated Applicable_Platforms, Maintenance_Notes, Relationships, Time_of_Introduction, Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Demonstrative_Examples, Description

CWE-657 詳細

CWE-657