Partial String Comparison

Opis

The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.

For example, an attacker might succeed in authentication by providing a small password that matches the associated portion of the larger, correct password.

Skutki

• Integrity, Access Control

  Alter Execution Logic; Bypass Protection Mechanism

Zapobieganie

• Testing

  Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.

Przykłady podatności

• CVE-2014-6394 Product does not prevent access to restricted directories due to partial string comparison with a public directory
• CVE-2004-1012 Argument parser of an IMAP server treats a partial command "body[p" as if it is "body.peek", leading to index error and out-of-bounds corruption.
• CVE-2004-0765 Web browser only checks the hostname portion of a certificate when the hostname portion of the URI is not a fully qualified domain name (FQDN), which allows remote attackers to spoof trusted certificates.
• CVE-2002-1374 One-character password by attacker checks only against first character of real password.
• CVE-2000-0979 One-character password by attacker checks only against first character of real password.

Słabość nadrzędna

• CWE-1023 Incomplete Comparison with Missing Factors

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific, Not Technology-Specific

Uwagi

This is conceptually similar to other weaknesses, such as insufficient verification and regular expression errors. It is primary to some weaknesses.