Improper Verification of Cryptographic Signature

Opis

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Skutki

• Access Control, Integrity, Confidentiality

  Gain Privileges or Assume Identity; Modify Application Data; Execute Unauthorized Code or Commands

  An attacker could gain access to sensitive data and possibly execute unauthorized code.

Przykłady podatności

• CVE-2002-1796 Does not properly verify signatures for "trusted" entities.
• CVE-2005-2181 Insufficient verification allows spoofing.
• CVE-2005-2182 Insufficient verification allows spoofing.
• CVE-2002-1706 Accepts a configuration file without a Message Integrity Check (MIC) signature.

Słabość nadrzędna

• CWE-345 Insufficient Verification of Data Authenticity

Kiedy powstaje

• Architecture and Design
• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

Not Language-Specific