875
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 345 Insufficient Verification of Data Authenticity 851
PeerOf 354 Improper Validation of Integrity Check Value 876
PeerOf 354 Improper Validation of Integrity Check Value 876
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1020 Verify Message Integrity 2434
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1214 Data Integrity Issues 2477
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Integrity
Other
Other
Data that is parsed and used may be corrupted.
Non-Repudiation
Other
Hide Activities
Other
Without a checksum it is impossible to determine if any
changes have been made to the data after it was sent.
Potential Mitigations
Phase: Architecture and Design
Add an appropriately sized checksum to the protocol, ensuring that data received may be simply
validated before it is parsed and used.
Phase: Implementation
Ensure that the checksums present in the protocol design are properly implemented and added
to each message before it is sent.
Demonstrative Examples
Example 1:
In this example, a request packet is received, and privileged information is sent to the requester:
Example Language: Java (Bad)
while(true) {
DatagramPacket rp = new DatagramPacket(rData,rData.length);
outSock.receive(rp);
InetAddress IPAddress = rp.getAddress();
int port = rp.getPort();
out = secret.getBytes();
DatagramPacket sp =new DatagramPacket(out, out.length, IPAddress, port);
CWE Version 4.14
CWE-354: Improper Validation of Integrity Check Value
CWE-354: Improper Validation of Integrity Check Value