878
Scope Impact Likelihood
Without a checksum check, it is impossible to determine if
any changes have been made to the data after it was sent.
Potential Mitigations
Phase: Implementation
Ensure that the checksums present in messages are properly checked in accordance with the
protocol specification before they are parsed and used.
Demonstrative Examples
Example 1:
The following example demonstrates the weakness.
Example Language: C (Bad)
sd = socket(AF_INET, SOCK_DGRAM, 0); serv.sin_family = AF_INET;
serv.sin_addr.s_addr = htonl(INADDR_ANY);
servr.sin_port = htons(1008);
bind(sd, (struct sockaddr *) & serv, sizeof(serv));
while (1) {
memset(msg, 0x0, MAX_MSG);
clilen = sizeof(cli);
if (inet_ntoa(cli.sin_addr)==...) n = recvfrom(sd, msg, MAX_MSG, 0, (struct sockaddr *) & cli, &clilen);
}
Example Language: Java (Bad)
while(true) {
DatagramPacket packet = new DatagramPacket(data,data.length,IPAddress, port);
socket.send(sendPacket);
}
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 993 SFP Secondary Cluster: Incorrect Input Handling 888 2417
MemberOf 1411 Comprehensive Categorization: Insufficient Verification
of Data Authenticity
1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
ISA/IEC 62443 Part 3-3 Req SR 3.1
CLASP Failure to check integrity check value
Related Attack Patterns
CAPEC-ID Attack Pattern Name
75 Manipulating Writeable Configuration Files
145 Checksum Spoofing
463 Padding Oracle Crypto Attack
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE Version 4.14
CWE-356: Product UI does not Warn User of Unsafe Actions
CWE-356: Product UI does not Warn User of Unsafe Actions