CWE-421 当访问候选通道时的竞争条件

Race Condition During Access to Alternate Channel

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: unkown

基本描述

The product opens an alternate channel to communicate with an authorized user, but the channel is accessible to other actors.

扩展描述

This creates a race condition that allows an attacker to access the channel before the authorized user does.

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 420 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 420 cwe_View_ID: 699 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 362 cwe_View_ID: 1000

  • cwe_Nature: ChildOf cwe_CWE_ID: 362 cwe_View_ID: 699

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围 影响 注释
Access Control ['Gain Privileges or Assume Identity', 'Bypass Protection Mechanism']

分析过的案例

标识 说明 链接
CVE-1999-0351 FTP "Pizza Thief" vulnerability. Attacker can connect to a port that was intended for use by another client. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0351
CVE-2003-0230 Product creates Windows named pipe during authentication that another attacker can hijack by connecting to it. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0230

分类映射

映射的分类名 ImNode ID Fit Mapped Node Name
PLOVER Alternate Channel Race Condition

引用