이름: Improper Check for Certificate Revocation

The product does not check or incorrectly checks the revocation status of a certificate.

일반 정보

취약점 도입 방식

Implementation : When the product uses certificate pinning, the developer might not properly validate all relevant components of the certificate before pinning the certificate. This can make it difficult or expensive to test after the pinning is complete.
Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)

기술

클래스: Not Technology-Specific (Undetermined)
클래스: Web Based (Undetermined)

일반적인 결과

범위	영향	가능성
Access Control	Gain Privileges or Assume Identity 참고: Trust may be assigned to an untrusted entity who somehow obtained the certificate, i.e., the entity is not who it claims to be.
Integrity Other	Other 참고: Data from an untrusted (and possibly malicious) source may be integrated.
Confidentiality	Read Application Data 참고: Data may be disclosed to an untrusted entity that obtained access to the certificate, thereby impersonating a trusted entity, resulting in information disclosure.

관찰된 예시

참고 자료	설명
CVE-2011-2014	LDAP-over-SSL implementation does not check Certificate Revocation List (CRL), allowing spoofing using a revoked certificate.
CVE-2011-0199	Operating system does not check Certificate Revocation List (CRL) in some cases, allowing spoofing using a revoked certificate.
CVE-2010-5185	Antivirus product does not check whether certificates from signed executables have been revoked.
CVE-2009-3046	Web browser does not check if any intermediate certificates are revoked.
CVE-2009-0161	Chain: Ruby module for OCSP misinterprets a response, preventing detection of a revoked certificate.
CVE-2011-2701	Chain: incorrect parsing of replies from OCSP responders allows bypass using a revoked certificate.
CVE-2011-0935	Router can permanently cache certain public keys, which would allow bypass if the certificate is later revoked.
CVE-2009-1358	Chain: OS package manager does not properly check the return value, allowing bypass using a revoked certificate.
CVE-2009-0642	Chain: language interpreter does not properly check the return value from an OSCP function, allowing bypass using a revoked certificate.
CVE-2008-4679	Chain: web service component does not call the expected method, which prevents a check for revoked certificates.
CVE-2006-4410	Certificate revocation list not searched for certain certificates.
CVE-2006-4409	Product cannot access certificate revocation list when an HTTP proxy is being used.

잠재적 완화 방법

Phases : Architecture and Design
Ensure that certificates are checked for revoked status.
Phases : Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the revoked status.

탐지 방법

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
효과성 : High

취약점 매핑 메모

근거 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
댓글 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

메모

An improper check for certificate revocation is a far more serious flaw than related certificate failures. This is because the use of any revoked certificate is almost certainly malicious. The most common reason for certificate revocation is compromise of the system in question, with the result that no legitimate servers will be using a revoked certificate, unless they are sorely out of sync.

참고 자료

REF-18

The CLASP Application Security Process
Secure Software, Inc..
https://cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf

REF-44

24 Deadly Sins of Software Security
Michael Howard, David LeBlanc, John Viega.

제출

이름	조직	날짜	출시일	Version
CLASP		2006-07-19 +00:00	2006-07-19 +00:00	Draft 3

수정 사항

이름	조직	날짜	댓글
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings
CWE Content Team	MITRE	2009-03-10 +00:00	updated Description, Name, Relationships
CWE Content Team	MITRE	2009-05-27 +00:00	updated Relationships
CWE Content Team	MITRE	2010-12-13 +00:00	updated Other_Notes
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated References, Relationships
CWE Content Team	MITRE	2013-02-21 +00:00	updated Applicable_Platforms, Demonstrative_Examples, Description, Observed_Examples, Other_Notes, Relationships, Type
CWE Content Team	MITRE	2013-07-17 +00:00	updated Relationships
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Demonstrative_Examples, Modes_of_Introduction, Relationships, Type
CWE Content Team	MITRE	2018-03-27 +00:00	updated Modes_of_Introduction, Potential_Mitigations, Time_of_Introduction
CWE Content Team	MITRE	2019-09-19 +00:00	updated Demonstrative_Examples
CWE Content Team	MITRE	2020-02-24 +00:00	updated References, Relationships
CWE Content Team	MITRE	2023-01-31 +00:00	updated Demonstrative_Examples, Description, Modes_of_Introduction
CWE Content Team	MITRE	2023-04-27 +00:00	updated Detection_Factors, Relationships, Time_of_Introduction
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-12-11 +00:00	updated Applicable_Platforms, Relationships, Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Description, Diagram, Other_Notes

CWE-299 상세 정보

CWE-299