1189
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Invoking untrusted mobile code
The CERT Oracle Secure
Coding Standard for Java
(2011)
SEC06-J Do not rely on the default automatic
signature verification provided by
URLClassLoader and java.util.jar
Software Fault Patterns SFP27 Tainted input to environment
Related Attack Patterns
CAPEC-ID Attack Pattern Name
184 Software Integrity Attack
185 Malicious Software Download
186 Malicious Software Update
187 Malicious Automated Software Update via Redirection
533 Malicious Manual Software Update
538 Open-Source Library Manipulation
657 Malicious Automated Software Update via Spoofing
662 Adversary in the Browser (AiTB)
691 Spoof Open-Source Software Metadata
692 Spoof Version Control System Commit Metadata
693 StarJacking
695 Repo Jacking
References
[REF-454]Microsoft. "Introduction to Code Signing". < http://msdn.microsoft.com/en-us/library/
ms537361(VS.85).aspx >.
[REF-455]Microsoft. "Authenticode". < http://msdn.microsoft.com/en-us/library/
ms537359(v=VS.85).aspx >.
[REF-456]Apple. "Code Signing Guide". Apple Developer Connection. 2008 November 9. < https://
web.archive.org/web/20080724215143/http://developer.apple.com/documentation/Security/
Conceptual/CodeSigningGuide/Introduction/chapter_1_section_1.html >.2023-04-07.
[REF-457]Anthony Bellissimo, John Burgess and Kevin Fu. "Secure Software Updates:
Disappointments and New Challenges". < http://prisms.cs.umass.edu/~kevinfu/papers/
secureupdates-hotsec06.pdf >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-459]Johannes Ullrich. "Top 25 Series - Rank 20 - Download of Code Without Integrity
Check". 2010 April 5. SANS Software Security Institute. < https://www.sans.org/blog/top-25-seriesrank-
20-download-of-code-without-integrity-check/ >.2023-04-07.
[REF-76]Sean Barnum and Michael Gegick. "Least Privilege". 2005 September 4. < https://
web.archive.org/web/20211209014121/https://www.cisa.gov/uscert/bsi/articles/knowledge/
principles/least-privilege >.2023-04-07.
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE-495: Private Data Structure Returned From A Public Method
Weakness ID : 495
Structure : Simple
Abstraction : Variant
CWE Version 4.14
CWE-495: Private Data Structure Returned From A Public Method
CWE-495: Private Data Structure Returned From A Public Method