CWE-206
Observable Internal Behavioral Discrepancy
2006-07-19
00h00 +00:00
00h00 +00:00
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Tên: Observable Internal Behavioral Discrepancy
The product performs multiple behaviors that are combined to produce a single result, but the individual behaviors are observable separately in a way that allows attackers to reveal internal state or internal decision points.
Thông tin chung
Các cách xuất hiện
Architecture and DesignImplementation
Nền tảng áp dụng
Ngôn ngữ
Lớp: Not Language-Specific (Undetermined)Hậu quả phổ biến
| Phạm vi | Tác động | Khả năng xảy ra |
|---|---|---|
| Confidentiality Access Control | Read Application Data, Bypass Protection Mechanism |
Ví dụ đã quan sát
| Tài liệu tham khảo | Mô tả |
|---|---|
CVE-2002-2031 | File existence via infoleak monitoring whether "onerror" handler fires or not. |
CVE-2005-2025 | Valid groupname enumeration via behavioral infoleak (sends response if valid, doesn't respond if not). |
CVE-2001-1497 | Behavioral infoleak in GUI allows attackers to distinguish between alphanumeric and non-alphanumeric characters in a password, thus reducing the search space. |
CVE-2003-0190 | Product immediately sends an error message when user does not exist instead of waiting until the password is provided, allowing username enumeration. |
Các biện pháp giảm thiểu tiềm năng
Phases : Requirements // ImplementationPhases : System Configuration // Implementation
For error pages, set up generic response pages for error conditions. The error page should not disclose information about the success or failure of a sensitive operation. For instance, the login page should not confirm that the login is correct and the password incorrect. The attacker who tries random account names may be able to guess some of them. Confirming that the account exists would make the login page more susceptible to brute force attack, or possibly leak information about the person who has the account.
Ghi chú ánh xạ lỗ hổng
Lý do : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
Sửa đổi
| Tên | Tổ chức | Ngày | Bình luận |
|---|---|---|---|
| Eric Dalci | Cigital | updated Potential_Mitigations, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Name | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Applicable_Platforms | |
| CWE Content Team | MITRE | updated Description, Name, Potential_Mitigations, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Description, Potential_Mitigations |
