CWE-941
Incorrectly Specified Destination in a Communication Channel
2014-02-19
00h00 +00:00
00h00 +00:00
指定 CWE 通知
掌握特定 CWE 的任何變更。
名稱: Incorrectly Specified Destination in a Communication Channel
The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.
一般資訊
引入方式
Architecture and DesignSystem Configuration : While the most common occurrence is likely due to misconfiguration by an administrator, this can be resultant from other weaknesses.
Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.
適用平台
程式語言
類別： Not Language-Specific (Undetermined)技術
類別： Mobile (Undetermined)常見後果
| 範圍 | 影響 | 可能性 |
|---|---|---|
| Access Control Other | Gain Privileges or Assume Identity, Varies by Context, Bypass Protection Mechanism |
觀察到的案例
| 參考資料 | 描述 |
|---|---|
CVE-2013-5211 | composite: NTP feature generates large responses (high amplification factor) with spoofed UDP source addresses. |
CVE-1999-0513 | Classic "Smurf" attack, using spoofed ICMP packets to broadcast addresses. |
CVE-1999-1379 | DNS query with spoofed source address causes more traffic to be returned to spoofed address than was sent by the attacker. |
漏洞對應備注
理由說明 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.備註 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
參考資料
REF-941
UDP-based Amplification AttacksUS-CERT.
https://www.cisa.gov/ncas/alerts/TA14-017A
REF-942
Android Bad Practices: Sticky BroadcastFortify.
https://www.hpe.com/us/en/solutions/infrastructure-security.html?jumpid=va_wnmstr1ug6_aid-510326901
提交
| 名稱 | 機構 | 日期 | 發布日期 | Version |
|---|---|---|---|---|
| CWE Content Team | MITRE | 2.6 |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| CWE Content Team | MITRE | updated Modes_of_Introduction, References, Relationships | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Relationships | |
| CWE Content Team | MITRE | updated Maintenance_Notes | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated References, Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated References | |
| CWE Content Team | MITRE | updated Common_Consequences, Relationships, Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Common_Consequences, Description, Modes_of_Introduction, Technical_Nuance, Time_of_Introduction, Weakness_Ordinalities |
