引入方式
Implementation
適用平台
程式語言
類別： Not Language-Specific (Undetermined)
常見後果
| 範圍 |
影響 |
可能性 |
| Other | Alter Execution Logic, Other | |
觀察到的案例
| 參考資料 |
描述 |
| Java code in a smartphone OS can encounter a "boot loop" due to an uncaught exception |
| Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint). The code's whitespace indentation did not reflect the actual control flow (CWE-1114) and did not explicitly delimit the block (CWE-483), which could have made it more difficult for human code auditors to detect the vulnerability. |
偵測方法
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
漏洞對應備注
理由說明 : This CWE entry is a Class and might have Base-level children that would be more appropriate
備註 : Examine children of this entry to see if there is a better fit
提交
| 名稱 |
機構 |
日期 |
發布日期 |
Version |
| CWE Content Team |
MITRE |
2008-09-09 +00:00 |
2008-09-09 +00:00 |
1.0 |
修改記錄
| 名稱 |
機構 |
日期 |
備註 |
| Eric Dalci |
Cigital |
2008-07-01 +00:00 |
updated Time_of_Introduction |
| CWE Content Team |
MITRE |
2008-11-24 +00:00 |
updated Relationships, Taxonomy_Mappings |
| CWE Content Team |
MITRE |
2011-03-29 +00:00 |
updated Relationships |
| CWE Content Team |
MITRE |
2011-06-01 +00:00 |
updated Common_Consequences, Relationships, Taxonomy_Mappings |
| CWE Content Team |
MITRE |
2011-09-13 +00:00 |
updated Relationships, Taxonomy_Mappings |
| CWE Content Team |
MITRE |
2012-05-11 +00:00 |
updated Relationships, Taxonomy_Mappings |
| CWE Content Team |
MITRE |
2014-06-23 +00:00 |
updated Observed_Examples |
| CWE Content Team |
MITRE |
2014-07-30 +00:00 |
updated Relationships |
| CWE Content Team |
MITRE |
2017-01-19 +00:00 |
updated Relationships |
| CWE Content Team |
MITRE |
2017-11-08 +00:00 |
updated Applicable_Platforms, Relationships, Taxonomy_Mappings |
| CWE Content Team |
MITRE |
2019-01-03 +00:00 |
updated Relationships, Taxonomy_Mappings |
| CWE Content Team |
MITRE |
2020-02-24 +00:00 |
updated Observed_Examples, Relationships |
| CWE Content Team |
MITRE |
2021-03-15 +00:00 |
updated Relationships |
| CWE Content Team |
MITRE |
2021-07-20 +00:00 |
updated Observed_Examples |
| CWE Content Team |
MITRE |
2023-01-31 +00:00 |
updated Description |
| CWE Content Team |
MITRE |
2023-04-27 +00:00 |
updated Relationships, Time_of_Introduction |
| CWE Content Team |
MITRE |
2023-06-29 +00:00 |
updated Mapping_Notes |
| CWE Content Team |
MITRE |
2024-02-29 +00:00 |
updated Demonstrative_Examples, Observed_Examples |
| CWE Content Team |
MITRE |
2025-12-11 +00:00 |
updated Detection_Factors, Observed_Examples, Relationships, Weakness_Ordinalities |
| CWE Content Team |
MITRE |
2026-10-28 +00:00 |
updated Relationships |
