1432
Reference Description
CVE-2005-0039 An IPSec configuration does not perform integrity checking of the IPSec packet
as the result of either not configuring ESP properly to support the integrity
service or using AH improperly. In either case, the security gateway receiving
the IPSec packet would not validate the integrity of the packet to ensure that
it was not changed. Thus if the packets were intercepted the attacker could
undetectably change some of the bits in the packets. The meaningful bit
flipping was possible due to the known weaknesses in the CBC encryption
mode. Since the attacker knew the structure of the packet, they were able
(in one variation of the attack) to use bit flipping to change the destination IP
of the packet to the destination machine controlled by the attacker. And so
the destination security gateway would decrypt the packet and then forward
the plaintext to the machine controlled by the attacker. The attacker could
then read the original message. For instance if VPN was used with the
vulnerable IPSec configuration the attacker could read the victim's e-mail. This
vulnerability demonstrates the need to enforce the integrity service properly
when critical data could be modified by an attacker. This problem might have
also been mitigated by using an encryption mode that is not susceptible to
bit flipping attacks, but the preferred mechanism to address this problem still
remains message verification for integrity. While this attack focuses on the
network layer and requires an entity that controls part of the communication
path such as a router, the situation is not much different at the software level,
where an attacker can modify tokens/parameters used by the application.
https://www.cve.org/CVERecord?id=CVE-2005-0039
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 975 SFP Secondary Cluster: Architecture 888 2406
MemberOf 1411 Comprehensive Categorization: Insufficient Verification
of Data Authenticity
1400 2538
Related Attack Patterns
CAPEC-ID Attack Pattern Name
463 Padding Oracle Crypto Attack
CWE-650: Trusting HTTP Permission Methods on the Server Side
Weakness ID : 650
Structure : Simple
Abstraction : Variant
Description
The server contains a protection mechanism that assumes that any URI that is accessed using
HTTP GET will not cause a state change to the associated resource. This might allow attackers to
bypass intended access restrictions and conduct resource modification and deletion attacks, since
some applications allow GET to modify state.
Extended Description
The HTTP GET method and some other methods are designed to retrieve resources and not
to alter the state of the application or resources on the server side. Furthermore, the HTTP
specification requires that GET requests (and other requests) should not have side effects.
CWE Version 4.14
CWE-651: Exposure of WSDL File Containing Sensitive Information
CWE-651: Exposure of WSDL File Containing Sensitive Information