CWE-347 密码学签名的验证不恰当

Improper Verification of Cryptographic Signature

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: unkown

基本描述

The software does not verify, or incorrectly verifies, the cryptographic signature for data.

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围	影响	注释
['Access Control', 'Integrity', 'Confidentiality']	['Gain Privileges or Assume Identity', 'Modify Application Data', 'Execute Unauthorized Code or Commands']	An attacker could gain access to sensitive data and possibly execute unauthorized code.

示例代码

例

In the following code, a JarFile object is created from a downloaded file.

bad Java

File f = new File(downloadedFilePath);
JarFile jf = new JarFile(f);

The JAR file that was potentially downloaded from an untrusted source is created without verifying the signature (if present). An alternate constructor that accepts a boolean verify parameter should be used instead.

分析过的案例

标识	说明	链接
CVE-2002-1796	Does not properly verify signatures for "trusted" entities.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1796
CVE-2005-2181	Insufficient verification allows spoofing.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2181
CVE-2005-2182	Insufficient verification allows spoofing.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2182
CVE-2002-1706	Accepts a configuration file without a Message Integrity Check (MIC) signature.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1706

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
PLOVER			Improperly Verified Signature
The CERT Oracle Secure Coding Standard for Java (2011)	SEC06-J		Do not rely on the default automatic signature verification provided by URLClassLoader and java.util.jar

VULHUB ™