1645
Demonstrative Examples
Example 1:
The example below attempts to build an RSA cipher.
Example Language: Java (Bad)
public Cipher getRSACipher() {
Cipher rsa = null;
try {
rsa = javax.crypto.Cipher.getInstance("RSA/NONE/NoPadding");
}
catch (java.security.NoSuchAlgorithmException e) {
log("this should never happen", e);
}
catch (javax.crypto.NoSuchPaddingException e) {
log("this should never happen", e);
}
return rsa;
}
While the previous code successfully creates an RSA cipher, the cipher does not use padding. The
following code creates an RSA cipher using OAEP.
Example Language: Java (Good)
public Cipher getRSACipher() {
Cipher rsa = null;
try {
rsa = javax.crypto.Cipher.getInstance("RSA/ECB/OAEPWithMD5AndMGF1Padding");
}
catch (java.security.NoSuchAlgorithmException e) {
log("this should never happen", e);
}
catch (javax.crypto.NoSuchPaddingException e) {
log("this should never happen", e);
}
return rsa;
}
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1346 OWASP Top Ten 2021 Category A02:2021 -
Cryptographic Failures
1344 2488
MemberOf 1402 Comprehensive Categorization: Encryption 1400 2527
Notes
Maintenance
This entry could probably have a new parent related to improper padding, however the role of
padding in cryptographic algorithms can vary, such as hiding the length of the plaintext and
providing additional random bits for the cipher. In general, cryptographic problems in CWE are
not well organized and further research is needed.
References
[REF-694]Ronald L. Rivest and Burt Kaliski. "RSA Problem". 2003 December 0. < http://
people.csail.mit.edu/rivest/RivestKaliski-RSAProblem.pdf >.
CWE Version 4.14
CWE-781: Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code
CWE-781: Improper Address Validation in
IOCTL with METHOD_NEITHER I/O Control Code 1646
[REF-695]"Optimal Asymmetric Encryption Padding". 2009 July 8. Wikipedia. < https://
en.wikipedia.org/wiki/Optimal_asymmetric_encryption_padding >.2023-04-07.
CWE-781: Improper Address Validation in IOCTL with METHOD_NEITHER I/O
Control Code
Weakness ID : 781
Structure : Simple
Abstraction : Variant
Description
The product defines an IOCTL that uses METHOD_NEITHER for I/O, but it does not validate or
incorrectly validates the addresses that are provided.
Extended Description
When an IOCTL uses the METHOD_NEITHER option for I/O control, it is the responsibility of the
IOCTL to validate the addresses that have been supplied to it. If validation is missing or incorrect,
attackers can supply arbitrary memory addresses, leading to code execution or a denial of service.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1285 Improper Validation of Specified Index, Position, or Offset in
Input