|
|
|
|
CWE-421: Race Condition During Access to Alternate Channel | |
| | Race Condition During Access to Alternate Channel |
|
| Weakness ID: 421 (Weakness Base) | | Status: Draft |
 Description
Description Summary The product opens an alternate channel to communicate with an
authorized user, but the channel is accessible to other
actors.
Extended Description
This creates a race condition that allows an attacker to access the
channel before the authorized user does.
Time of Introduction Observed Examples | Reference | Description |
|---|
| CVE-1999-0351 | FTP "Pizza Thief" vulnerability. Attacker can
connect to a port that was intended for use by another
client. |
| CVE-2003-0230 | Product creates Windows named pipe during
authentication that another attacker can hijack by connecting to
it. |
Potential Mitigations | Phase | Description |
|---|
| Protect access to resources. Enforce an authentication check on every
transaction. |
Other Notes
|
Predictability can be a factor in some issues.
|
Relationships Affected Resources Taxonomy Mappings | Mapped Taxonomy Name | Node ID | Fit | Mapped Node Name |
|---|
| PLOVER | | | Alternate Channel Race Condition |
References Content History | Submissions |
|---|
| Submission Date | Submitter | Organization | Source |
|---|
| PLOVER | | Externally Mined | | | Modifications |
|---|
| Modification Date | Modifier | Organization | Source |
|---|
| 2008-07-01 | Eric Dalci | Cigital | External | | updated Potential Mitigations,
Time of Introduction | | 2008-09-08 | CWE Content Team | MITRE | Internal | | updated Relationships, Observed Example, Other Notes,
Taxonomy Mappings, Type | | 2008-10-14 | CWE Content Team | MITRE | Internal | | updated Description | | 2009-01-12 | CWE Content Team | MITRE | Internal | | updated References |
|
