CAPEC-475
Signature Spoofing by Improper Validation
2014-06-23
00h00 +00:00
00h00 +00:00
Cảnh báo cho một CAPEC
Luôn được thông báo về mọi thay đổi đối với một CAPEC cụ thể.
Mô tả CAPEC
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.
Thông tin CAPEC
Điều kiện tiên quyết
Recipient is using a weak cryptographic signature verification algorithm or a weak implementation of a cryptographic signature verification algorithm, or the configuration of the recipient's application accepts the use of keys generated using cryptographically weak signature verification algorithms.Kỹ năng cần thiết
Cryptanalysis of signature verification algorithmReverse engineering and cryptanalysis of signature verification algorithm implementation
Các biện pháp giảm thiểu
Use programs and products that contain cryptographic elements that have been thoroughly tested for flaws in the signature verification routines.Điểm yếu liên quan
| Tên điểm yếu | |
|---|---|
CWE-347 |
Improper Verification of Cryptographic Signature The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
CWE-327 |
Use of a Broken or Risky Cryptographic Algorithm The product uses a broken or risky cryptographic algorithm or protocol. |
CWE-295 |
Improper Certificate Validation The product does not validate, or incorrectly validates, a certificate. |
Tài liệu tham khảo
REF-562
Microsoft's Chain of FoolsKenn White.
https://blog.lessonslearned.org/chain-of-fools/
REF-563
Patch Critical Cryptographic Vulnerability in Microsoft Windows Clients and Servershttps://media.defense.gov/2020/Jan/14/2002234275/-1/-1/0/CSA-WINDOWS-10-CRYPT-LIB-20190114.PDF
REF-564
Analysis of REF-563Thomas Ptacek, Thomas Pornin.
https://news.ycombinator.com/item?id=22048619
Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
Sửa đổi
| Tên | Tổ chức | Ngày | Bình luận |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Example_Instances, References, Related_Attack_Patterns, Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Example_Instances | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Example_Instances, Extended_Description |
