Injection problem - Revision history

KirstenS at 18:05, 11 April 2009

2009-04-11T18:05:27Z

KirstenS: /* Examples */

2009-04-11T18:04:51Z

‎Examples

KirstenS at 01:23, 21 February 2009

2009-02-21T01:23:37Z

KirstenS at 02:31, 18 February 2009

2009-02-18T02:31:48Z

KirstenS at 14:28, 2 November 2008

2008-11-02T14:28:13Z

KirstenS at 18:23, 27 October 2008

2008-10-27T18:23:01Z

KirstenS at 14:12, 26 September 2008

2008-09-26T14:12:00Z

KirstenS at 14:04, 26 September 2008

2008-09-26T14:04:33Z

KirstenS: /* Related problems */

2008-09-25T11:53:22Z

‎Related problems

Owaspkkb: /* Consequences */

2006-10-02T01:04:22Z

‎Consequences

@@ Line 1: / Line 1: @@
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 ==Description==
@@ Line 89: / Line 86: @@
 __NOTOC__

@@ Line 53: / Line 53: @@
 ==Examples==
-Injection problems describe a large subset of problems with varied instantiations. For an example of one of these problems, see the section [[Format string problem]].
+Injection problems describe a large subset of problems with varied instantiations. For an example of one of these problems, see the section [[Format String]].
 ==Related [[Attacks]]==

@@ Line 1: / Line 1: @@
 {{Template:Vulnerability}}
 {{Template:SecureSoftware}}
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 ==Description==

@@ Line 1: / Line 1: @@
 {{Template:Vulnerability}}
 {{Template:SecureSoftware}}
+<br>
 [[ASDR Table of Contents]]

@@ Line 1: / Line 1: @@
 {{Template:SecureSoftware}}
-{{Template:Vulnerability}}
+__TOC__
-Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
-[[ASDR Table of Contents]]
+Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''

@@ Line 97: / Line 97: @@
 [[Category:OWASP ASDR Project]]
 [[Category:Vulnerability]]
 [[Category:OWASP_CLASP_Project]]
 [[Category:Input Validation Vulnerability]]

@@ Line 57: / Line 57: @@
 ==Examples==
-===Short example name===
+Injection problems describe a large subset of problems with varied instantiations. For an example of one of these problems, see the section [[Format string problem]].
 ==Related [[Attacks]]==
@@ Line 72: / Line 67: @@
 ==Related [[Vulnerabilities]]==
-* [[Vulnerability 1]]
+* [[SQL injection]]
-* [[Vulnerabiltiy 2]]
+* [[Format String]]
@@ Line 92: / Line 91: @@
 TBD
 __NOTOC__
@@ Line 122: / Line 96: @@
 [[Category:OWASP ASDR Project]]
 [[Category:Vulnerability]]
 [[Category:Input Validation]]
 [[Category:OWASP_CLASP_Project]]

@@ Line 1: / Line 1: @@
 {{Template:SecureSoftware}}
-==Overview==
+{{Template:Vulnerability}}
 Injection problems span a wide range of instantiations. The basic form of this flaw involves the injection of control-plane data into the data-plane in order to alter the control flow of the process.
-==Consequences ==
+'''Consequences'''
-*	Confidentiality: Many injection attacks involve the disclosure of important information - in terms of both data sensitivity and usefulness in further exploitation
+TBD
-*	Authentication: In some cases injectable code controls authentication; this may lead to remote vulnerability
+[[Category:FIXME|add links
-*	Access Control: Injection attacks are characterized by the ability to significantly change the flow of a given process, and in some cases, to the execution of arbitrary code.
+In addition, one should classify vulnerability based on the following subcategories: Ex:<nowiki>[[Category:Error Handling Vulnerability]]</nowiki>
-*	Integrity: Data injection attacks lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing.
+Availability Vulnerability
-*	Accountability: Often the actions performed by injected control code are unlogged.
+Authorization Vulnerability
-==Exposure period ==
+Authentication Vulnerability
-*	Requirements specification: A language might be chosen which is not subject to these issues.
+Concurrency Vulnerability
-*	Implementation: Many logic errors can contribute to these issues.
+Configuration Vulnerability
-==Platform ==
+Cryptographic Vulnerability
-*	Languages: C, C++, Assembly, SQL
+Encoding Vulnerability
-*	Platforms: Any
+Error Handling Vulnerability
-==Required resources ==
+Input Validation Vulnerability
-Any
+Logging and Auditing Vulnerability
-==Severity ==
+Session Management Vulnerability]]
-High
+__NOTOC__
-Very High
+[[Category:OWASP ASDR Project]]
-*	Requirements specification: A language might be chosen which is not subject to these issues.
+==Overview==
-==Discussion ==
+==Avoidance and mitigation ==
-The most important issue to note is that all injection problems share one thing in common - i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed.
+==Discussion ==
 ==Examples ==

@@ Line 63: / Line 63: @@
 *	[[SQL injection]]
-*	[[Format string problem]]
+*	[[Format String]]
 *	[[Command injection]]