Monthly Archives: May 2022

CWE

CWE-759 – Use of a One-Way Hash without a Salt

Read Time:1 Minute, 43 Second

Description

The software uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the software does not also use a salt as part of the input.

In cryptography, salt refers to some random addition of data to an input before hashing to make dictionary attacks more difficult.

Modes of Introduction:

– Implementation

Likelihood of Exploit:

 

Related Weaknesses

CWE-916

 

Consequences

Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity

If an attacker can gain access to the hashes, then the lack of a salt makes it easier to conduct brute force attacks using techniques such as rainbow tables.

 

Potential Mitigations

Phase: Architecture and Design

Effectiveness: High

Description: 

Phase: Architecture and Design

Effectiveness: Limited

Description: 

If a technique that requires extra computational effort can not be implemented, then for each password that is processed, generate a new random salt using a strong random number generator with unpredictable seeds. Add the salt to the plaintext password before hashing it. When storing the hash, also store the salt. Do not use the same salt for every password.

Be aware that salts will not reduce the workload of a targeted attack against an individual hash (such as the password for a critical person), and in general they are less effective than other hashing techniques such as increasing the computation time or memory overhead. Without a built-in workload, modern attacks can compute large numbers of hashes, or even exhaust the entire space of all possible passwords, within a very short amount of time, using massively-parallel computing and GPU, ASIC, or FPGA hardware.

Phase: Implementation, Architecture and Design

Effectiveness:

Description: 

When using industry-approved techniques, use them correctly. Don’t cut corners by skipping resource-intensive steps (CWE-325). These steps are often essential for preventing common attacks.

CVE References

 

  • CVE-2008-1526
    • Router does not use a salt with a hash, making it easier to crack passwords.
  • CVE-2006-1058
    • Router does not use a salt with a hash, making it easier to crack passwords.
CWE

CWE-758 – Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Read Time:31 Second

Description

The software uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.

This can lead to resultant weaknesses when the required properties change, such as when the software is ported to a different platform or if an interaction error (CWE-435) occurs.

Modes of Introduction:

Likelihood of Exploit:

 

Related Weaknesses

CWE-710

 

Consequences

Other: Other

 

Potential Mitigations

CVE References

 

  • CVE-2006-1902
    • Change in C compiler behavior causes resultant buffer overflows in programs that depend on behaviors that were undefined in the C standard.
CWE

CWE-757 – Selection of Less-Secure Algorithm During Negotiation (‘Algorithm Downgrade’)

Read Time:1 Minute, 18 Second

Description

A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.

When a security mechanism can be forced to downgrade to use a less secure algorithm, this can make it easier for attackers to compromise the software by exploiting weaker algorithm. The victim might not be aware that the less secure algorithm is being used. For example, if an attacker can force a communications channel to use cleartext instead of strongly-encrypted data, then the attacker could read the channel by sniffing, instead of going through extra effort of trying to decrypt the data using brute force techniques.

Modes of Introduction:

– Architecture and Design

Likelihood of Exploit:

 

Related Weaknesses

CWE-693

 

Consequences

Access Control: Bypass Protection Mechanism

 

Potential Mitigations

CVE References

 

  • CVE-2006-4302
    • Attacker can select an older version of the software to exploit its vulnerabilities.
  • CVE-2006-4407
    • Improper prioritization of encryption ciphers during negotiation leads to use of a weaker cipher.
  • CVE-2005-2969
    • chain: SSL/TLS implementation disables a verification step (CWE-325) that enables a downgrade attack to a weaker protocol.
  • CVE-2001-1444
    • Telnet protocol implementation allows downgrade to weaker authentication and encryption using an Adversary-in-the-Middle AITM attack.
  • CVE-2002-1646
    • SSH server implementation allows override of configuration setting to use weaker authentication schemes. This may be a composite with CWE-642.
CWE

CWE-756 – Missing Custom Error Page

Read Time:20 Second

Description

The software does not return custom error pages to the user, possibly exposing sensitive information.

Modes of Introduction:

Likelihood of Exploit:

 

Related Weaknesses

CWE-755
CWE-209

 

Consequences

Confidentiality: Read Application Data

Attackers can leverage the additional information provided by a default error page to mount attacks targeted on the framework, database, or other resources used by the application.

 

Potential Mitigations

CVE References

 

CWE

CWE-755 – Improper Handling of Exceptional Conditions

Read Time:31 Second

Description

The software does not handle or incorrectly handles an exceptional condition.

Modes of Introduction:

– Implementation

Likelihood of Exploit: Medium

 

Related Weaknesses

CWE-703

 

Consequences

Other: Other

 

Potential Mitigations

CVE References

 

  • CVE-2021-3011
    • virtual interrupt controller in a virtualization product allows crash of host by writing a certain invalid value to a register, which triggers a fatal error instead of returning an error code
  • CVE-2008-4302
    • Chain: OS kernel does not properly handle a failure of a function call (CWE-755), leading to an unlock of a resource that was not locked (CWE-832), with resultant crash.
CWE

CWE-754 – Improper Check for Unusual or Exceptional Conditions

Read Time:2 Minute, 27 Second

Description

The software does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software.

Many functions will return some value about the success of their actions. This will alert the program whether or not to handle any errors caused by that function.

Modes of Introduction:

– Implementation

Likelihood of Exploit: Medium

 

Related Weaknesses

CWE-703

 

Consequences

Integrity, Availability: DoS: Crash, Exit, or Restart, Unexpected State

The data which were produced as a result of a function call could be in a bad state upon return. If the return value is not checked, then this bad data may be used in operations, possibly leading to a crash or other unintended behaviors.

 

Potential Mitigations

Phase: Requirements

Effectiveness:

Description: 

Phase: Implementation

Effectiveness: High

Description: 

Check the results of all functions that return a value and verify that the value is expected.

Checking the return value of the function will typically be sufficient, however beware of race conditions (CWE-362) in a concurrent environment.

Phase: Implementation

Effectiveness: High

Description: 

If using exception handling, catch and throw specific exceptions instead of overly-general exceptions (CWE-396, CWE-397). Catch and handle exceptions as locally as possible so that exceptions do not propagate too far up the call stack (CWE-705). Avoid unchecked or uncaught exceptions where feasible (CWE-248).

Using specific exceptions, and ensuring that exceptions are checked, helps programmers to anticipate and appropriately handle many unusual events that could occur.

Phase: Implementation

Effectiveness:

Description: 

Phase: Implementation

Effectiveness:

Description: 

Performing extensive input validation does not help with handling unusual conditions, but it will minimize their occurrences and will make it more difficult for attackers to trigger them.

Phase: Architecture and Design, Implementation

Effectiveness:

Description: 

If the program must fail, ensure that it fails gracefully (fails closed). There may be a temptation to simply let the program fail poorly in cases such as low memory conditions, but an attacker may be able to assert control before the software has fully exited. Alternately, an uncontrolled failure could cause cascading problems with other downstream components; for example, the program could send a signal to a downstream process so the process immediately knows that a problem has occurred and has a better chance of recovery.

Phase: Architecture and Design

Effectiveness:

Description: 

Use system limits, which should help to prevent resource exhaustion. However, the software should still handle low resource conditions since they may still occur.

CVE References

 

  • CVE-2007-3798
    • Unchecked return value leads to resultant integer overflow and code execution.
  • CVE-2006-4447
    • Program does not check return value when invoking functions to drop privileges, which could leave users with higher privileges than expected by forcing those functions to fail.
  • CVE-2006-2916
    • Program does not check return value when invoking functions to drop privileges, which could leave users with higher privileges than expected by forcing those functions to fail.
CWE

CWE-75 – Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Read Time:27 Second

Description

The software does not adequately filter user-controlled input for special elements with control implications.

Modes of Introduction:

– Architecture and Design

Likelihood of Exploit:

 

Related Weaknesses

CWE-74

 

Consequences

Integrity, Confidentiality, Availability: Modify Application Data, Execute Unauthorized Code or Commands

 

Potential Mitigations

Phase: Requirements

Effectiveness:

Description: 

Programming languages and supporting technologies might be chosen which are not subject to these issues.

Phase: Implementation

Effectiveness:

Description: 

Utilize an appropriate mix of allowlist and denylist parsing to filter special element syntax from all input.

CVE References

 

CWE

CWE-749 – Exposed Dangerous Method or Function

Read Time:52 Second

Description

The software provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

Modes of Introduction:

– Architecture and Design

Likelihood of Exploit: Low

 

Related Weaknesses

CWE-664
CWE-691

 

Consequences

Integrity, Confidentiality, Availability, Access Control, Other: Gain Privileges or Assume Identity, Read Application Data, Modify Application Data, Execute Unauthorized Code or Commands, Other

Exposing critical functionality essentially provides an attacker with the privilege level of the exposed functionality. This could result in the modification or exposure of sensitive data or possibly even execution of arbitrary code.

 

Potential Mitigations

Phase: Architecture and Design

Effectiveness:

Description: 

If you must expose a method, make sure to perform input validation on all arguments, limit access to authorized parties, and protect against all possible vulnerabilities.

Phase: Architecture and Design, Implementation

Effectiveness:

Description: 

CVE References

 

  • CVE-2007-1112
    • security tool ActiveX control allows download or upload of files
CWE

CWE-74 – Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’)

Read Time:2 Minute, 2 Second

Description

The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Software has certain assumptions about what constitutes data and control respectively. It is the lack of verification of these assumptions for user-controlled input that leads to injection problems. Injection problems encompass a wide variety of issues — all mitigated in very different ways and usually attempted in order to alter the control flow of the process. For this reason, the most effective way to discuss these weaknesses is to note the distinct features which classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common — i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed. The most classic instantiations of this category of weakness are SQL injection and format string vulnerabilities.

Modes of Introduction:

– Architecture and Design

Likelihood of Exploit: High

 

Related Weaknesses

CWE-707

 

Consequences

Confidentiality: Read Application Data

Many injection attacks involve the disclosure of important information — in terms of both data sensitivity and usefulness in further exploitation.

Access Control: Bypass Protection Mechanism

In some cases, injectable code controls authentication; this may lead to a remote vulnerability.

Other: Alter Execution Logic

Injection attacks are characterized by the ability to significantly change the flow of a given process, and in some cases, to the execution of arbitrary code.

Integrity, Other: Other

Data injection attacks lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing.

Non-Repudiation: Hide Activities

Often the actions performed by injected control code are unlogged.

 

Potential Mitigations

Phase: Requirements

Effectiveness:

Description: 

Programming languages and supporting technologies might be chosen which are not subject to these issues.

Phase: Implementation

Effectiveness:

Description: 

Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

CVE References

 

CWE

CWE-733 – Compiler Optimization Removal or Modification of Security-critical Code

Read Time:30 Second

Description

The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the program such that the mechanism is removed or modified.

Modes of Introduction:

Likelihood of Exploit:

 

Related Weaknesses

CWE-1038

 

Consequences

Access Control, Other: Bypass Protection Mechanism, Other

 

Potential Mitigations

CVE References

 

  • CVE-2008-1685
    • C compiler optimization, as allowed by specifications, removes code that is used to perform checks to detect integer overflows.
  • CVE-2019-1010006
    • Chain: compiler optimization (CWE-733) removes or modifies code used to detect integer overflow (CWE-190), allowing out-of-bounds write (CWE-787).