1447
be recorded for a given switch interface, while other interfaces may keep functioning normally.
Configuration options can be provided on the appropriate actions to be taken in case of a detected
failure, but safe defaults should be used.
Example 2:
The IPSEC specification is complex, which resulted in bugs, partial implementations, and
incompatibilities between vendors.
Example 3:
When executable library files are used on web servers, which is common in PHP applications,
the developer might perform an access check in any user-facing executable, and omit the access
check from the library file itself. By directly requesting the library file (CWE-425), an attacker can
bypass this access check.
Example 4:
Single sign-on technology is intended to make it easier for users to access multiple resources or
domains without having to authenticate each time. While this is highly convenient for the user and
attempts to address problems with psychological acceptability, it also means that a compromise of
a user's credentials can provide immediate access to all other resources or domains.
Example 5:
The design of TCP relies on the secrecy of Initial Sequence Numbers (ISNs), as originally covered
in CVE-1999-0077 [REF-542]. If ISNs can be guessed (due to predictability, CWE-330) or sniffed
(due to lack of encryption during transmission, CWE-312), then an attacker can hijack or spoof
connections. Many TCP implementations have had variations of this problem over the years,
including CVE-2004-0641, CVE-2002-1463, CVE-2001-0751, CVE-2001-0328, CVE-2001-0288,
CVE-2001-0163, CVE-2001-0162, CVE-2000-0916, and CVE-2000-0328.
Example 6:
The "SweynTooth" vulnerabilities in Bluetooth Low Energy (BLE) software development kits (SDK)
were found to affect multiple Bluetooth System-on-Chip (SoC) manufacturers. These SoCs were
used by many products such as medical devices, Smart Home devices, wearables, and other IoT
devices. [REF-1314] [REF-1315]
Observed Examples
Reference Description
CVE-2019-6260 Baseboard Management Controller (BMC) device implements Advanced Highperformance
Bus (AHB) bridges that do not require authentication for arbitrary
read and write access to the BMC's physical address space from the host, and
possibly the network [REF-1138].
https://www.cve.org/CVERecord?id=CVE-2019-6260
CVE-2007-5277 The failure of connection attempts in a web browser resets DNS pin
restrictions. An attacker can then bypass the same origin policy by rebinding a
domain name to a different IP address. This was an attempt to "fail functional."
https://www.cve.org/CVERecord?id=CVE-2007-5277
CVE-2006-7142 Hard-coded cryptographic key stored in executable program.
https://www.cve.org/CVERecord?id=CVE-2006-7142
CVE-2007-0408 Server does not properly validate client certificates when reusing cached
connections.
https://www.cve.org/CVERecord?id=CVE-2007-0408
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-662: Improper Synchronization
CWE-662: Improper Synchronization