COMMON WEAKNESS ENUMERATIONDraft

CWE-593

Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created

The product modifies the SSL context after connection creation has begun.

Soyutlama

Variant

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

The product modifies the SSL context after connection creation has begun.

Genişletilmiş açıklama

If the program modifies the SSL_CTX object after creating SSL objects from it, there is the possibility that older SSL objects created from the original context could all be affected by that change.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Implementation

REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Risk

Başarılı sömürü neye yol açar?

Bypass Protection Mechanism

Etkilenen güvenlik alanları: Access Control

No authentication takes place in this process, bypassing an assumed protection of encryption.
Read Application Data

Etkilenen güvenlik alanları: Confidentiality

The encrypted communication between a user and a trusted host may be subject to a sniffing attack.

Savunma

Nasıl önlenir ve çözülür?

Architecture and Design

Mimari ve tasarım yaklaşımı

Detay
Use a language or a library that provides a cryptography framework at a higher level of abstraction.

Implementation

Uygulama aşaması savunması

Detay
Most SSL_CTX functions have SSL counterparts that act on SSL-type objects.

Implementation

Uygulama aşaması savunması

Detay
Applications should set up an SSL_CTX completely, before creating SSL objects from it.