CWE - CWE-358: Improperly Implemented Security Check for Standard (2.11)

Weakness ID: 358

Abstraction: Base

Status: Draft

Presentation Filter:

Description

Description Summary

The software does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.

Time of Introduction

Architecture and Design
Implementation

Applicable Platforms

Languages

All

Modes of Introduction

This is an implementation error, in which the algorithm/technique requires certain security-related behaviors or conditions that are not implemented or checked properly, thus causing a vulnerability.

Common Consequences

Scope	Effect
Access Control	Technical Impact: Bypass protection mechanism

Observed Examples

Reference	Description
CVE-2002-0862	Browser does not verify Basic Constraints of a certificate, even though it is required, allowing spoofing of trusted certificates.
CVE-2002-0970	Browser does not verify Basic Constraints of a certificate, even though it is required, allowing spoofing of trusted certificates.
CVE-2002-1407	Browser does not verify Basic Constraints of a certificate, even though it is required, allowing spoofing of trusted certificates.
CVE-2005-0198	Logic error prevents some required conditions from being enforced during Challenge-Response Authentication Mechanism with MD5 (CRAM-MD5).
CVE-2004-2163	Shared secret not verified in a RADIUS response packet, allowing authentication bypass by spoofing server replies.
CVE-2005-2181	Insufficient verification in VoIP implementation, in violation of standard, allows spoofed messages.
CVE-2005-2182	Insufficient verification in VoIP implementation, in violation of standard, allows spoofed messages.
CVE-2005-2298	Security check not applied to all components, allowing bypass.

Relationships

Nature	Type	ID	Name	View(s) this relationship pertains to
ChildOf	Category	254	Security Features	Development Concepts (primary)699 Weaknesses for Simplified Mapping of Published Vulnerabilities (primary)1003
ChildOf	Weakness Class	573	Improper Following of Specification by Caller	Research Concepts (primary)1000
ChildOf	Weakness Class	693	Protection Mechanism Failure	Research Concepts1000
ChildOf	Category	978	SFP Secondary Cluster: Implementation	Software Fault Pattern (SFP) Clusters (primary)888
CanAlsoBe	Weakness Base	290	Authentication Bypass by Spoofing	Research Concepts1000
CanAlsoBe	Weakness Class	345	Insufficient Verification of Data Authenticity	Research Concepts1000
PeerOf	Weakness Base	325	Missing Required Cryptographic Step	Research Concepts1000

Relationship Notes

This is a "missing step" error on the product side, which can overlap weaknesses such as insufficient verification and spoofing. It is frequently found in cryptographic and authentication errors. It is sometimes resultant.

Taxonomy Mappings

Mapped Taxonomy Name	Node ID	Fit	Mapped Node Name
PLOVER			Improperly Implemented Security Check for Standard

Content History

Submissions
Submission Date	Submitter	Organization	Source
	PLOVER		Externally Mined

Modifications
Modification Date	Modifier	Organization	Source
2008-07-01	Eric Dalci	Cigital	External
2008-07-01	updated Time_of_Introduction
2008-09-08	CWE Content Team	MITRE	Internal
2008-09-08	updated Relationships, Other_Notes, Taxonomy_Mappings
2009-05-27	CWE Content Team	MITRE	Internal
2009-05-27	updated Description
2009-10-29	CWE Content Team	MITRE	Internal
2009-10-29	updated Modes_of_Introduction, Observed_Examples, Other_Notes, Relationship_Notes
2011-06-01	CWE Content Team	MITRE	Internal
2011-06-01	updated Common_Consequences, Relationships, Taxonomy_Mappings
2012-05-11	CWE Content Team	MITRE	Internal
2012-05-11	updated Relationships, Taxonomy_Mappings
2014-07-30	CWE Content Team	MITRE	Internal
2014-07-30	updated Relationships
2015-12-07	CWE Content Team	MITRE	Internal
2015-12-07	updated Relationships


	Use of the Common Weakness Enumeration and the associated references from this website are subject to the Terms of Use. For more information, please email cwe@mitre.org. CWE is sponsored by US-CERT in the office of Cybersecurity and Communications at the U.S. Department of Homeland Security. Copyright © 2006-2017, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.	Privacy policy Terms of use Contact us

Common Weakness Enumeration

CWE-358: Improperly Implemented Security Check for Standard