CWE-307
Improper Restriction of Excessive Authentication Attempts
2006-07-19
00h00 +00:00
00h00 +00:00
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Tên: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
Thông tin chung
Các cách xuất hiện
Architecture and Design : COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.Nền tảng áp dụng
Ngôn ngữ
Lớp: Not Language-Specific (Undetermined)Tên: Go (Undetermined)
Hậu quả phổ biến
| Phạm vi | Tác động | Khả năng xảy ra |
|---|---|---|
| Access Control | Bypass Protection Mechanism Ghi chú: An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account using a brute force attack. |
Ví dụ đã quan sát
| Tài liệu tham khảo | Mô tả |
|---|---|
CVE-2019-0039 | the REST API for a network OS has a high limit for number of connections, allowing brute force password guessing |
CVE-1999-1152 | Product does not disconnect or timeout after multiple failed logins. |
CVE-2001-1291 | Product does not disconnect or timeout after multiple failed logins. |
CVE-2001-0395 | Product does not disconnect or timeout after multiple failed logins. |
CVE-2001-1339 | Product does not disconnect or timeout after multiple failed logins. |
CVE-2002-0628 | Product does not disconnect or timeout after multiple failed logins. |
CVE-1999-1324 | User accounts not disabled when they exceed a threshold; possibly a resultant problem. |
Các biện pháp giảm thiểu tiềm năng
Phases : Architecture and DesignPhases : Architecture and Design
Phương pháp phát hiện
Dynamic Analysis with Automated Results Interpretation
Hiệu quả : HighDynamic Analysis with Manual Results Interpretation
Hiệu quả : HighManual Static Analysis - Source Code
Hiệu quả : HighAutomated Static Analysis - Source Code
Hiệu quả : SOAR PartialAutomated Static Analysis
Hiệu quả : SOAR PartialArchitecture or Design Review
Hiệu quả : HighGhi chú ánh xạ lỗ hổng
Lý do : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Mẫu tấn công liên quan
| ID CAPEC | Tên mẫu tấn công |
|---|---|
| CAPEC-16 | Dictionary-based Password Attack
|
| CAPEC-49 | Password Brute Forcing
An adversary tries every possible value for a password until they succeed. A brute force attack, if feasible computationally, will always be successful because it will essentially go through all possible passwords given the alphabet used (lower case letters, upper case letters, numbers, symbols, etc.) and the maximum length of the password. |
| CAPEC-560 | Use of Known Domain Credentials
|
| CAPEC-565 | Password Spraying
|
| CAPEC-600 | Credential Stuffing
|
| CAPEC-652 | Use of Known Kerberos Credentials
An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain. |
| CAPEC-653 | Use of Known Operating System Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate operating system credentials (e.g. userID/password) to achieve authentication and to perform authorized actions on the system, under the guise of an authenticated user or service. This applies to any Operating System. |
Tài liệu tham khảo
REF-45
OWASP Enterprise Security API (ESAPI) ProjectOWASP.
https://owasp.org/www-project-enterprise-security-api/
REF-236
Weak Password Brings 'Happiness' to Twitter HackerKim Zetter.
https://www.wired.com/2009/01/professed-twitt/
REF-1218
This Black Box Can Brute Force Crack iPhone PIN PasscodesGraham Cluley.
https://www.intego.com/mac-security-blog/iphone-pin-pass-code/
REF-1479
State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and EvaluationGregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy.
https://www.ida.org/-/media/feature/publications/s/st/stateoftheart-resources-soar-for-software-vulnerability-detection-test-and-evaluation/p-5061.ashx
REF-1482
D3FEND: D3-TL Trusted LibraryD3FEND.
https://d3fend.mitre.org/technique/d3f:TrustedLibrary/
REF-1355
dmi_jtag.svFlorian Zaruba.
https://github.com/HACK-EVENT/hackatdac21/blob/71103971e8204de6a61afc17d3653292517d32bf/piton/design/chip/tile/ariane/src/riscv-dbg/src/dmi_jtag.sv#L192:L204
REF-1566
Golang Secure Coding Practices guideOWASP.
https://github.com/OWASP/Go-SCP
Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
Sửa đổi
| Tên | Tổ chức | Ngày | Bình luận |
|---|---|---|---|
| Sean Eidemiller | Cigital | added/updated demonstrative examples | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Observed_Examples | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Demonstrative_Examples, Potential_Mitigations | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Name, Potential_Mitigations, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Demonstrative_Examples | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Common_Consequences, Related_Attack_Patterns, Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations, References, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Detection_Factors, Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Modes_of_Introduction, Relationships | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Relationships | |
| CWE Content Team | MITRE | updated Detection_Factors, Relationships | |
| CWE Content Team | MITRE | updated Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, References, Relationships | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Description, Observed_Examples, References, Relationships | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, References, Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Common_Consequences, Description, Diagram | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Detection_Factors, Potential_Mitigations, References | |
| CWE Content Team | MITRE | updated Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Demonstrative_Examples, References, Relationships, Taxonomy_Mappings |
