CWE-354: Improper Validation of Integrity Check Value
Improper Validation of Integrity Check Value
Weakness ID: 354 (Weakness Base)
Status: Draft
Description
Description Summary
The software does not validate or incorrectly validates the
integrity check values or "checksums" of a message. This may prevent it from
detecting if the data has been modified or corrupted in transmission.
Extended Description
: The failure to validate checksums before use results in an unnecessary
risk that can easily be mitigated. The protocol specification describes the
algorithm used for calculating the checksum. It is then a simple matter of
implementing the calculation and verifying that the calculated checksum and
the received checksum match. Failure to verify the calculated checksum and
the received checksum can lead to far greater consequences.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Authentication
Integrity checks usually use a secret key that helps authenticate the
data origin. Skipping integrity checking generally opens up the
possibility that new data from an invalid source can be injected.
Integrity
Data that is parsed and used may be corrupted.
Non-Repudiation
Without a checksum check, it is impossible to determine if any changes
have been made to the data after it was sent.
Description
