名称: Observable Behavioral Discrepancy
The product's behaviors indicate important differences that may be observed by unauthorized actors in a way that reveals (1) its internal state or decision process, or (2) differences from other products with equivalent functionality.
基本信息
引入方式
Architecture and DesignImplementation
适用平台
编程语言
类： Not Language-Specific (Undetermined)常见后果
| 影响范围 | 影响 | 可能性 |
|---|---|---|
| Confidentiality Access Control | Read Application Data, Bypass Protection Mechanism 注意： Attackers could use knowledge of these internal operations to simplify or optimize their attack. In some cases, behavioral discrepancies can be used by attackers to form a side channel. |
观察示例
| 参考资料 | 描述 |
|---|---|
CVE-2002-0208 | Product modifies TCP/IP stack and ICMP error messages in unusual ways that show the product is in use. |
CVE-2004-2252 | Behavioral infoleak by responding to SYN-FIN packets. |
潜在缓解措施
Phases : ImplementationIdeally, a product should provide as little information about its internal operations as possible.
漏洞映射说明
依据 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.备注 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
相关攻击模式
| CAPEC ID | 攻击模式名称 |
|---|---|
| CAPEC-541 | Application Fingerprinting
An adversary engages in fingerprinting activities to determine the type or version of an application installed on a remote target. |
| CAPEC-580 | System Footprinting
An adversary engages in active probing and exploration activities to determine security information about a remote target system. Often times adversaries will rely on remote applications that can be probed for system configurations. |
提交记录
| 名称 | 组织 | 日期 | 发布日期 | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
修改记录
| 名称 | 组织 | 日期 | 备注 |
|---|---|---|---|
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Description, Name | |
| CWE Content Team | MITRE | updated Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Applicable_Platforms | |
| CWE Content Team | MITRE | updated Description, Name, Observed_Examples, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Related_Attack_Patterns | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description, Potential_Mitigations |
