727
Demonstrative Examples
Example 1:
The following OpenSSL code ensures that there is a certificate and allows the use of expired
certificates.
Example Language: C (Bad)
if (cert = SSL_get_peer(certificate(ssl)) {
foo=SSL_get_verify_result(ssl);
if ((X509_V_OK==foo) || (X509_V_ERR_CERT_HAS_EXPIRED==foo))
//do stuff
If the call to SSL_get_verify_result() returns X509_V_ERR_CERT_HAS_EXPIRED, this means
that the certificate has expired. As time goes on, there is an increasing chance for attackers to
compromise the certificate.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 724 OWASP Top Ten 2004 Category A3 - Broken
Authentication and Session Management
711 2335
MemberOf 948 SFP Secondary Cluster: Digital Certificate 888 2395
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Failure to validate certificate expiration
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-299: Improper Check for Certificate Revocation
Weakness ID : 299
Structure : Simple
Abstraction : Base
Description
The product does not check or incorrectly checks the revocation status of a certificate, which may
cause it to use a certificate that has been compromised.
Extended Description
An improper check for certificate revocation is a far more serious flaw than related certificate
failures. This is because the use of any revoked certificate is almost certainly malicious. The most
common reason for certificate revocation is compromise of the system in question, with the result
that no legitimate servers will be using a revoked certificate, unless they are sorely out of sync.
Relationships
CWE Version 4.14
CWE-299: Improper Check for Certificate Revocation
CWE-299: Improper Check for Certificate Revocation