Improperly Implemented Security Check for Standard

Opis

The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.

Skutki

• Access Control

  Bypass Protection Mechanism

Przykłady podatności

• CVE-2002-0862 Browser does not verify Basic Constraints of a certificate, even though it is required, allowing spoofing of trusted certificates.
• CVE-2002-0970 Browser does not verify Basic Constraints of a certificate, even though it is required, allowing spoofing of trusted certificates.
• CVE-2002-1407 Browser does not verify Basic Constraints of a certificate, even though it is required, allowing spoofing of trusted certificates.
• CVE-2005-0198 Logic error prevents some required conditions from being enforced during Challenge-Response Authentication Mechanism with MD5 (CRAM-MD5).
• CVE-2004-2163 Shared secret not verified in a RADIUS response packet, allowing authentication bypass by spoofing server replies.
• CVE-2005-2181 Insufficient verification in VoIP implementation, in violation of standard, allows spoofed messages.
• CVE-2005-2182 Insufficient verification in VoIP implementation, in violation of standard, allows spoofed messages.
• CVE-2005-2298 Security check not applied to all components, allowing bypass.

Słabość nadrzędna

• CWE-573 Improper Following of Specification by Caller
• CWE-693 Protection Mechanism Failure

Może też być

• CWE-345 Insufficient Verification of Data Authenticity
• CWE-290 Authentication Bypass by Spoofing

Kiedy powstaje

• Architecture and Design
• Implementation — This is an implementation error, in which the algorithm/technique requires certain security-related behaviors or conditions that are not implemented or checked properly, thus causing a vulnerability.

Dotyczy

Not Language-Specific

Uwagi

This is a "missing step" error on the product side, which can overlap weaknesses such as insufficient verification and spoofing. It is frequently found in cryptographic and authentication errors. It is sometimes resultant.