756
Phase: Architecture and Design
Use a mechanism for determining the strength of a password and notify the user of weak
password use.
Phase: Architecture and Design
Inform the user of why password protections are in place, how they work to protect data integrity,
and why it is important to heed their warnings.
Demonstrative Examples
Example 1:
In both of these examples, a user is logged in if their given password matches a stored password:
Example Language: C (Bad)
unsigned char *check_passwd(char *plaintext) {
ctext = simple_digest("sha1",plaintext,strlen(plaintext), ... );
//Login if hash matches stored hash
if (equal(ctext, secret_password())) {
login_user();
}
}
Example Language: Java (Bad)
String plainText = new String(plainTextIn);
MessageDigest encer = MessageDigest.getInstance("SHA");
encer.update(plainTextIn);
byte[] digest = password.digest();
//Login if hash matches stored hash
if (equal(digest,secret_password())) {
login_user();
}
This code relies exclusively on a password mechanism (CWE-309) using only one factor of
authentication (CWE-308). If an attacker can steal or guess a user's password, they are given full
access to their account. Note this code also uses SHA-1, which is a weak hash (CWE-328). It also
does not use a salt (CWE-759).
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 724 OWASP Top Ten 2004 Category A3 - Broken
Authentication and Session Management
711 2335
MemberOf 947 SFP Secondary Cluster: Authentication Bypass 888 2394
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Using password systems
OWASP Top Ten 2004 A3 CWE More Specific Broken Authentication and Session
Management
Related Attack Patterns
CAPEC-ID Attack Pattern Name
16 Dictionary-based Password Attack
CWE Version 4.14
CWE-311: Missing Encryption of Sensitive Data
CWE-311: Missing Encryption of Sensitive Data