CWE-593
Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
2006-12-15
00h00 +00:00
00h00 +00:00
指定 CWE 通知
随时了解指定 CWE 的变更。
名称: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
The product modifies the SSL context after connection creation has begun.
基本信息
引入方式
Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.适用平台
编程语言
类： Not Language-Specific (Undetermined)常见后果
| 影响范围 | 影响 | 可能性 |
|---|---|---|
| Access Control | Bypass Protection Mechanism 注意： No authentication takes place in this process, bypassing an assumed protection of encryption. | |
| Confidentiality | Read Application Data 注意： If the program modifies the SSL_CTX object after creating SSL objects from it, there is the possibility that older SSL objects created from the original context could all be affected by that change. The encrypted communication between a user and a trusted host may be subject to a sniffing attack. |
潜在缓解措施
Phases : Architecture and DesignUse a language or a library that provides a cryptography framework at a higher level of abstraction.
Phases : Implementation
Most SSL_CTX functions have SSL counterparts that act on SSL-type objects.
Phases : Implementation
Applications should set up an SSL_CTX completely, before creating SSL objects from it.
漏洞映射说明
依据 : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.备注 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
相关攻击模式
| CAPEC ID | 攻击模式名称 |
|---|---|
| CAPEC-94 | Adversary in the Middle (AiTM)
|
提交记录
| 名称 | 组织 | 日期 | 发布日期 | Version |
|---|---|---|---|---|
| CWE Community | Draft 5 |
修改记录
| 名称 | 组织 | 日期 | 备注 |
|---|---|---|---|
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Common_Consequences, Relationships, Other_Notes | |
| CWE Content Team | MITRE | updated Description, Other_Notes, Potential_Mitigations | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations, Relationships | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Modes_of_Introduction, Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description |
