CAPEC-75
Manipulating Writeable Configuration Files
2014-06-23
00h00 +00:00
00h00 +00:00
指定 CAPEC 提醒
随时了解指定 CAPEC 的变更。
CAPEC 描述
Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.
CAPEC 信息
前提条件
Configuration files must be modifiable by the attacker所需技能
To identify vulnerable configuration files, and understand how to manipulate servers and erase forensic evidence缓解措施
Design: Enforce principle of least privilegeDesign: Backup copies of all configuration files
Implementation: Integrity monitoring for configuration files
Implementation: Enforce audit logging on code and configuration promotion procedures.
Implementation: Load configuration from separate process and memory space, for example a separate physical device like a CD
相关弱点
| 弱点名称 | |
|---|---|
CWE-349 |
Acceptance of Extraneous Untrusted Data With Trusted Data The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted. |
CWE-99 |
Improper Control of Resource Identifiers The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended control sphere. |
CWE-77 |
Improper Neutralization of Special Elements used in a Command The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
CWE-346 |
Origin Validation Error The product does not properly verify that the source of data or communication is valid. |
CWE-353 |
Missing Support for Integrity Check The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum. |
CWE-354 |
Improper Validation of Integrity Check Value The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. |
参考资料
REF-1
Exploiting Software: How to Break CodeG. Hoglund, G. McGraw.
提交记录
| 名称 | 组织 | 日期 | 发布日期 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
修改记录
| 名称 | 组织 | 日期 | 备注 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Example_Instances |
