877
The product does not validate or incorrectly validates the integrity check values or "checksums"
of a message. This may prevent it from detecting if the data has been modified or corrupted in
transmission.
Extended Description
Improper validation of checksums before use results in an unnecessary risk that can easily be
mitigated. The protocol specification describes the algorithm used for calculating the checksum. It
is then a simple matter of implementing the calculation and verifying that the calculated checksum
and the received checksum match. Improper verification of the calculated checksum and the
received checksum can lead to far greater consequences.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 754 Improper Check for Unusual or Exceptional Conditions 1568
ChildOf 345 Insufficient Verification of Data Authenticity 851
PeerOf 353 Missing Support for Integrity Check 874
PeerOf 353 Missing Support for Integrity Check 874
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 345 Insufficient Verification of Data Authenticity 851
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1020 Verify Message Integrity 2434
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1214 Data Integrity Issues 2477
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Integrity
Other
Modify Application Data
Other
Integrity checks usually use a secret key that helps
authenticate the data origin. Skipping integrity checking
generally opens up the possibility that new data from an
invalid source can be injected.
Integrity
Other
Other
Data that is parsed and used may be corrupted.
Non-Repudiation
Other
Hide Activities
Other
CWE Version 4.14
CWE-354: Improper Validation of Integrity Check Value
CWE-354: Improper Validation of Integrity Check Value