CAPEC-475
Signature Spoofing by Improper Validation
2014-06-23
00h00 +00:00
00h00 +00:00
특정 CAPEC 알림
특정 CAPEC의 변경 사항에 대한 정보를 받아보세요.
CAPEC 설명
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.
CAPEC 정보
사전 조건
Recipient is using a weak cryptographic signature verification algorithm or a weak implementation of a cryptographic signature verification algorithm, or the configuration of the recipient's application accepts the use of keys generated using cryptographically weak signature verification algorithms.필요 기술
Cryptanalysis of signature verification algorithmReverse engineering and cryptanalysis of signature verification algorithm implementation
완화 방법
Use programs and products that contain cryptographic elements that have been thoroughly tested for flaws in the signature verification routines.관련 약점
| 약점 이름 | |
|---|---|
CWE-347 |
Improper Verification of Cryptographic Signature The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
CWE-327 |
Use of a Broken or Risky Cryptographic Algorithm The product uses a broken or risky cryptographic algorithm or protocol. |
CWE-295 |
Improper Certificate Validation The product does not validate, or incorrectly validates, a certificate. |
참고 자료
REF-562
Microsoft's Chain of FoolsKenn White.
https://blog.lessonslearned.org/chain-of-fools/
REF-563
Patch Critical Cryptographic Vulnerability in Microsoft Windows Clients and Servershttps://media.defense.gov/2020/Jan/14/2002234275/-1/-1/0/CSA-WINDOWS-10-CRYPT-LIB-20190114.PDF
REF-564
Analysis of REF-563Thomas Ptacek, Thomas Pornin.
https://news.ycombinator.com/item?id=22048619
제출
| 이름 | 조직 | 날짜 | 출시일 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
수정 사항
| 이름 | 조직 | 날짜 | 댓글 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Example_Instances, References, Related_Attack_Patterns, Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Example_Instances | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Example_Instances, Extended_Description |
