|
|
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
CWE-778: Insufficient Logging
 DescriptionDescription Summary When a security-critical event occurs, the software either does not record the event or omits important details about the event when logging it.
Extended Description When security-critical events are not logged properly, such as a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analysis after an attack succeeds. Time of Introduction
Applicable PlatformsLanguages Language-independent Common Consequences
Likelihood of ExploitMedium Demonstrative ExamplesExample 1 The example below shows a configuration for the service security audit feature in the Windows Communication Foundation (WCF). (Bad Code) Example
Language: XML <system.serviceModel> <behaviors>
<serviceBehaviors>
<behavior name="NewBehavior">
<serviceSecurityAudit
auditLogLocation="Default"
suppressAuditFailure="false"
serviceAuthorizationAuditLevel="None"
messageAuthenticationAuditLevel="None"
/>
...
</system.serviceModel> The previous configuration file has effectively disabled the recording of security-critical events, which would force the administrator to look to other sources during debug or recovery efforts. Logging failed authentication attempts can warn administrators of potential brute force attacks. Similarly, logging successful authentication events can provide a useful audit trail when a legitimate account is compromised. The following configuration shows appropriate settings, assuming that the site does not have excessive traffic, which could fill the logs if there are a large number of success or failure events (CWE-779). (Good Code) Example
Language: XML <system.serviceModel> <behaviors>
<serviceBehaviors>
<behavior name="NewBehavior">
<serviceSecurityAudit
auditLogLocation="Default"
suppressAuditFailure="false"
serviceAuthorizationAuditLevel="SuccessAndFailure"
messageAuthenticationAuditLevel="SuccessAndFailure"
/>
...
</system.serviceModel> Observed Examples
Potential Mitigations
Relationships
Content History
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Page Last Updated:
September 12, 2011
|
|
CWE is a Software Assurance strategic initiative co-sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security. This Web site is sponsored and managed by The MITRE Corporation to enable stakeholder collaboration. Copyright © 2006-2012, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. Contact cwe@mitre.org for more information. |
|
|