Omission of Security-relevant Information

Opis

The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.

Skutki

• Non-Repudiation

  Hide Activities

  The source of an attack will be difficult or impossible to determine. This can allow attacks to the system to continue without notice.

Przykłady podatności

• CVE-1999-1029 Login attempts are not recorded if the user disconnects before the maximum number of tries.
• CVE-2002-1839 Sender's IP address not recorded in outgoing e-mail.
• CVE-2000-0542 Failed authentication attempts are not recorded if later attempt succeeds.

Słabość nadrzędna

• CWE-221 Information Loss or Omission

Słabości podrzędne

• CWE-778 Insufficient Logging
• CWE-1429 Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface

Kiedy powstaje

• Architecture and Design — OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.
• Implementation
• Operation

Dotyczy

Not Language-Specific

Źródła

1. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 2, "Accountability", Page 40, Addison Wesley, 2006