CAPEC-75
Manipulating Writeable Configuration Files
2014-06-23
00h00 +00:00
00h00 +00:00
指定 CAPEC 提醒
掌握特定 CAPEC 的任何變更。
CAPEC 描述
Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.
CAPEC 資訊
前置條件
Configuration files must be modifiable by the attacker所需技能
To identify vulnerable configuration files, and understand how to manipulate servers and erase forensic evidence緩解措施
Design: Enforce principle of least privilegeDesign: Backup copies of all configuration files
Implementation: Integrity monitoring for configuration files
Implementation: Enforce audit logging on code and configuration promotion procedures.
Implementation: Load configuration from separate process and memory space, for example a separate physical device like a CD
相關弱點
| 弱點名稱 | |
|---|---|
CWE-349 |
Acceptance of Extraneous Untrusted Data With Trusted Data The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted. |
CWE-99 |
Improper Control of Resource Identifiers The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended control sphere. |
CWE-77 |
Improper Neutralization of Special Elements used in a Command The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
CWE-346 |
Origin Validation Error The product does not properly verify that the source of data or communication is valid. |
CWE-353 |
Missing Support for Integrity Check The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum. |
CWE-354 |
Improper Validation of Integrity Check Value The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. |
參考資料
REF-1
Exploiting Software: How to Break CodeG. Hoglund, G. McGraw.
提交
| 名稱 | 機構 | 日期 | 發布日期 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns | |
| CAPEC Content Team | The MITRE Corporation | Updated Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Example_Instances |
