CWE-593
Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
2006-12-15
00h00 +00:00
00h00 +00:00
指定 CWE 通知
掌握特定 CWE 的任何變更。
名稱: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
The product modifies the SSL context after connection creation has begun.
一般資訊
引入方式
Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.適用平台
程式語言
類別： Not Language-Specific (Undetermined)常見後果
| 範圍 | 影響 | 可能性 |
|---|---|---|
| Access Control | Bypass Protection Mechanism 注意：No authentication takes place in this process, bypassing an assumed protection of encryption. | |
| Confidentiality | Read Application Data 注意： If the program modifies the SSL_CTX object after creating SSL objects from it, there is the possibility that older SSL objects created from the original context could all be affected by that change. The encrypted communication between a user and a trusted host may be subject to a sniffing attack. |
潛在緩解措施
Phases : Architecture and DesignUse a language or a library that provides a cryptography framework at a higher level of abstraction.
Phases : Implementation
Most SSL_CTX functions have SSL counterparts that act on SSL-type objects.
Phases : Implementation
Applications should set up an SSL_CTX completely, before creating SSL objects from it.
漏洞對應備注
理由說明 : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.備註 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
相關攻擊模式
| CAPEC ID | 攻擊模式名稱 |
|---|---|
| CAPEC-94 | Adversary in the Middle (AiTM)
|
提交
| 名稱 | 機構 | 日期 | 發布日期 | Version |
|---|---|---|---|---|
| CWE Community | Draft 5 |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| Eric Dalci | Cigital | updated Time_of_Introduction | |
| CWE Content Team | MITRE | updated Common_Consequences, Relationships, Other_Notes | |
| CWE Content Team | MITRE | updated Description, Other_Notes, Potential_Mitigations | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations, Relationships | |
| CWE Content Team | MITRE | updated Demonstrative_Examples, Modes_of_Introduction, Relationships | |
| CWE Content Team | MITRE | updated Common_Consequences, Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description |
