[Forgot Password]
Login  Register Subscribe

23631

 
 

115084

 
 

97559

 
 

909

 
 

78730

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CWE
view XML

Improper Validation of Host-specific Certificate Data

ID: 297Date: (C)2012-05-14   (M)2017-10-12
Type: weaknessStatus: INCOMPLETE
Abstraction Type: Base





Description

Host-specific certificate data is not validated or is incorrectly validated, so while the certificate read is valid, it may not be for the site originally requested.

Extended Description

If the host-specific data contained in a certificate is not checked, it may be possible for a redirection or spoofing attack to allow a malicious host with a valid certificate to provide data, impersonating a trusted host. While the attacker in question may have a valid certificate, it may simply be a valid certificate for a different site. In order to ensure data integrity, we must check that the certificate is valid and that it pertains to the site that we wish to access.

Likelihood of Exploit: High

Applicable Platforms
Language Class: All

Time Of Introduction

  • Architecture and Design

Common Consequences

ScopeTechnical ImpactNotes
Access_Control
 
Gain privileges / assume identity
 
The data read from the system vouched for by the certificate may not be from the expected system.
 
Authentication
Other
 
Other
 
Trust afforded to the system in question -- based on the expired certificate -- may allow for spoofing or redirection attacks.
 

Detection Methods
None

Potential Mitigations

PhaseStrategyDescriptionEffectivenessNotes
Architecture and Design
 
 Check for expired certificates and provide the user with adequate information about the nature of the problem and how to proceed.
 
  

Relationships

Related CWETypeViewChain
CWE-297 ChildOf CWE-898 Category CWE-888  

Demonstrative Examples
None

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings

TaxynomyIdNameFit
CLASP  Failure to validate host-specific certificate data
 
 

References:

  1. Michael Howard David LeBlanc John Viega .24 Deadly Sins of Software Security. McGraw-Hill. Section:'"Sin 23: Improper Use of PKI, Especially SSL." Page 347'. Published on 2010.

© 2013 SecPod Technologies