CAPEC-475
Signature Spoofing by Improper Validation
2014-06-23
00h00 +00:00
00h00 +00:00
指定 CAPEC 提醒
随时了解指定 CAPEC 的变更。
CAPEC 描述
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.
CAPEC 信息
前提条件
Recipient is using a weak cryptographic signature verification algorithm or a weak implementation of a cryptographic signature verification algorithm, or the configuration of the recipient's application accepts the use of keys generated using cryptographically weak signature verification algorithms.所需技能
Cryptanalysis of signature verification algorithmReverse engineering and cryptanalysis of signature verification algorithm implementation
缓解措施
Use programs and products that contain cryptographic elements that have been thoroughly tested for flaws in the signature verification routines.相关弱点
| 弱点名称 | |
|---|---|
CWE-347 |
Improper Verification of Cryptographic Signature The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
CWE-327 |
Use of a Broken or Risky Cryptographic Algorithm The product uses a broken or risky cryptographic algorithm or protocol. |
CWE-295 |
Improper Certificate Validation The product does not validate, or incorrectly validates, a certificate. |
参考资料
REF-562
Microsoft's Chain of FoolsKenn White.
https://blog.lessonslearned.org/chain-of-fools/
REF-563
Patch Critical Cryptographic Vulnerability in Microsoft Windows Clients and Servershttps://media.defense.gov/2020/Jan/14/2002234275/-1/-1/0/CSA-WINDOWS-10-CRYPT-LIB-20190114.PDF
REF-564
Analysis of REF-563Thomas Ptacek, Thomas Pornin.
https://news.ycombinator.com/item?id=22048619
提交记录
| 名称 | 组织 | 日期 | 发布日期 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
修改记录
| 名称 | 组织 | 日期 | 备注 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Example_Instances, References, Related_Attack_Patterns, Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Example_Instances | |
| CAPEC Content Team | The MITRE Corporation | Updated Description, Example_Instances, Extended_Description |
