Violation of Secure Design Principles

Opis

The product violates well-established principles for secure design.

This can introduce resultant weaknesses or make it easier for developers to introduce related weaknesses during implementation. Because code is centered around design, it can be resource-intensive to fix design problems.

Skutki

• Other

  Other

Przykłady podatności

• CVE-2019-6260 Baseboard Management Controller (BMC) device implements Advanced High-performance Bus (AHB) bridges that do not require authentication for arbitrary read and write access to the BMC's physical address space from the host, and possibly the network [REF-1138].
• CVE-2007-5277 The failure of connection attempts in a web browser resets DNS pin restrictions. An attacker can then bypass the same origin policy by rebinding a domain name to a different IP address. This was an attempt to "fail functional."
• CVE-2006-7142 Hard-coded cryptographic key stored in executable program.
• CVE-2007-0408 Server does not properly validate client certificates when reusing cached connections.

Słabość nadrzędna

• CWE-710 Improper Adherence to Coding Standards

Słabości podrzędne

• CWE-250 Execution with Unnecessary Privileges
• CWE-636 Not Failing Securely ('Failing Open')
• CWE-637 Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')
• CWE-638 Not Using Complete Mediation
• CWE-653 Improper Isolation or Compartmentalization
• CWE-654 Reliance on a Single Factor in a Security Decision
• CWE-655 Insufficient Psychological Acceptability
• CWE-656 Reliance on Security Through Obscurity
• CWE-671 Lack of Administrator Control over Security
• CWE-1192 Improper Identifier for IP Block used in System-On-Chip (SOC)
• CWE-1395 Dependency on Vulnerable Third-Party Component

Kiedy powstaje

• Architecture and Design

Dotyczy

Not Language-Specific, Not OS-Specific, Not Technology-Specific

Źródła

1. The Protection of Information in Computer Systems — Jerome H. Saltzer, Michael D. Schroeder, Proceedings of the IEEE 63, 1975
2. Design Principles — Sean Barnum, Michael Gegick, 2005
3. RFC: 793, TRANSMISSION CONTROL PROTOCOL — Jon Postel, Editor, Information Sciences Institute, 1981
4. CVE-2019-6260: Gaining control of BMC from the host processor — Stewart Smith, 2019
5. ICS Alert (ICS-ALERT-20-063-01): SweynTooth Vulnerabilities — ICS-CERT, 2020
6. Unleashing Mayhem over Bluetooth Low Energy — Matheus E. Garbelini, Sudipta Chattopadhyay, Chundong Wang, Singapore University of Technology and Design, 2020