1221
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 514 Covert Channel 1218
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 417 Communication Channel Errors 2325
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Covert storage channels may provide attackers with
important information about the system in question.
Integrity
Confidentiality
Read Application Data
If these messages or packets are sent with unnecessary
data contained within, it may tip off malicious listeners
as to the process that created the message. With this
information, attackers may learn any number of things,
including the hardware platform, operating system, or
algorithms used by the sender. This information can be of
significant value to the user in launching further attacks.
Potential Mitigations
Phase: Implementation
Ensure that all reserved fields are set to zero before messages are sent and that no unnecessary
information is included.
Demonstrative Examples
Example 1:
An excellent example of covert storage channels in a well known application is the ICMP error
message echoing functionality. Due to ambiguities in the ICMP RFC, many IP implementations use
the memory within the packet for storage or calculation. For this reason, certain fields of certain
packets -- such as ICMP error packets which echo back parts of received messages -- may contain
flaws or extra information which betrays information about the identity of the target operating
system. This information is then used to build up evidence to decide the environment of the target.
This is the first crucial step in determining if a given system is vulnerable to a particular flaw and
what changes must be made to malicious code to mount a successful attack.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 968 SFP Secondary Cluster: Covert Channel 888 2404
MemberOf 1415 Comprehensive Categorization: Resource Control 1400 2544
Notes
CWE Version 4.14
CWE-520: .NET Misconfiguration: Use of Impersonation
CWE-520: .NET Misconfiguration: Use of Impersonation