755
Nature Type ID Name Page
ChildOf 654 Reliance on a Single Factor in a Security Decision 1439
ChildOf 1390 Weak Authentication 2267
PeerOf 308 Use of Single-factor Authentication 752
PeerOf 262 Not Using Password Aging 633
PeerOf 308 Use of Single-factor Authentication 752
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1211 Authentication Errors 2475
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Background Details
Password systems are the simplest and most ubiquitous authentication mechanisms. However,
they are subject to such well known attacks,and such frequent compromise that their use in the
most simple implementation is not practical.
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Gain Privileges or Assume Identity
A password authentication mechanism error will almost
always result in attackers being authorized as valid users.
Potential Mitigations
Phase: Architecture and Design
In order to protect password systems from compromise, the following should be noted:
Passwords should be stored safely to prevent insider attack and to ensure that -- if a system
is compromised -- the passwords are not retrievable. Due to password reuse, this information
may be useful in the compromise of other systems these users work with. In order to protect
these passwords, they should be stored encrypted, in a non-reversible state, such that the
original text password cannot be extracted from the stored value. Password aging should be
strictly enforced to ensure that passwords do not remain unchanged for long periods of time. The
longer a password remains in use, the higher the probability that it has been compromised. For
this reason, passwords should require refreshing periodically, and users should be informed of
the risk of passwords which remain in use for too long. Password strength should be enforced
intelligently. Rather than restrict passwords to specific content, or specific length, users should
be encouraged to use upper and lower case letters, numbers, and symbols in their passwords.
The system should also ensure that no passwords are derived from dictionary words.
Phase: Architecture and Design
Use a zero-knowledge password protocol, such as SRP.
Phase: Architecture and Design
Ensure that passwords are stored safely and are not reversible.
Phase: Architecture and Design
Implement password aging functionality that requires passwords be changed after a certain
point.
CWE Version 4.14
CWE-309: Use of Password System for Primary Authentication
CWE-309: Use of Password System for Primary Authentication