Race Condition During Access to Alternate Channel

Opis

The product opens an alternate channel to communicate with an authorized user, but the channel is accessible to other actors.

This creates a race condition that allows an attacker to access the channel before the authorized user does.

Skutki

• Access Control

  Gain Privileges or Assume Identity; Bypass Protection Mechanism

Przykłady podatności

• CVE-1999-0351 FTP "Pizza Thief" vulnerability. Attacker can connect to a port that was intended for use by another client.
• CVE-2003-0230 Product creates Windows named pipe during authentication that another attacker can hijack by connecting to it.

Słabość nadrzędna

• CWE-420 Unprotected Alternate Channel
• CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Kiedy powstaje

• Architecture and Design

Dotyczy

Not Language-Specific

Źródła

1. Discovering and Exploiting Named Pipe Security Flaws for Fun and Profit — Blake Watts, 2002
2. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 13: Race Conditions." Page 205, McGraw-Hill, 2010