Race condition in checking for certificate revocation - Revision history

KirstenS at 12:24, 7 April 2009

2009-04-07T12:24:49Z

KirstenS at 00:22, 18 February 2009

2009-02-18T00:22:36Z

KirstenS at 23:55, 5 November 2008

2008-11-05T23:55:44Z

KirstenS at 13:14, 30 September 2008

2008-09-30T13:14:14Z

Weilin Zhong at 18:54, 16 June 2006

2006-06-16T18:54:22Z

Pravir Chandra at 04:08, 28 May 2006

2006-05-28T04:08:28Z

Deleted user at 18:32, 16 May 2006

2006-05-16T18:32:43Z

Deleted user at 16:31, 16 April 2006

2006-04-16T16:31:09Z

Jeff Williams at 22:44, 13 April 2006

2006-04-13T22:44:35Z

New page

{{Template:SecureSoftware}}

==Overview==

If the revocation status of a certificate is not checked before each privilege requiring action, the system may be subject to a race condition, in which their certificate may be used before it is checked for revocation.

==Consequences ==

* Authentication: Trust may be assigned to an entity who is not who it claims to be.

* Integrity: Data from an untrusted (and possibly malicious) source may be integrated.

* Confidentiality: Date may be disclosed to an entity impersonating a trusted entity, resulting in information disclosure.

==Exposure period ==

* Design: Checks for certificate revocation should be included in the design of a system

* Design: One can choose to use a language which abstracts out this part of the authentication process.

==Platform ==

* Languages: Languages which do not abstract out this part of the process.

* Operating platforms: All

==Required resources ==

Minor trust: Users must attempt to interact with the malicious system.

==Severity ==

Medium

==Likelihood of exploit ==

Medium

==Avoidance and mitigation ==

* Design: Ensure that certificates are checked for revoked status before each use of a protected resource

==Discussion ==

If a certificate is revoked after the initial check, all subsequent actions taken with the owner of the revoked certificate will loose all benefits guaranteed by the certificate. In fact, it is almost certain that the use of a revoked certificate indicates malicious activity.

If the certificate is checked before each access of a protected resource, the delay subject to a possible race condition becomes almost negligible and significantly reduces the risk associated with this issue.

==Examples ==

In C/C++:

if (!(cert = SSL_get_peer(certificate(ssl)) || !host)
foo=SSL_get_veryify_result(ssl);
if (X509_V_OK==foo)
//do stuff
foo=SSL_get_veryify_result(ssl);
//do more stuff without the check.

==Related problems ==

* Failure to follow chain of trust in certificate validation

* Failure to validate host-specific certificate data

* Failure to validate certificate expiration

* Failure to check for certificate revocation

==Categories ==

[[Category:Vulnerability]]

[[Category:Synchronization and Timing Errror]]

← Older revision		Revision as of 12:24, 7 April 2009
Line 5:		Line 5:
	__TOC__		__TOC__

−	~~[[ASDR Table of Contents]]~~

@@ Line 1: / Line 1: @@
-{{Template:Vulnerability}}
+{{template:CandidateForDeletion}}
-{{Template:SecureSoftware}}
 __TOC__
@@ Line 8: / Line 9: @@
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
@@ Line 98: / Line 96: @@
 * http://www.link1.com
 * [http://www.link2.com Title for the link2]

@@ Line 1: / Line 1: @@
 {{Template:SecureSoftware}}
-[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
+__TOC__
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
-[[ASDR Table of Contents]]
+[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]

@@ Line 73: / Line 73: @@
 [[Category:Vulnerability]]
-[[Category:Synchronization and Timing Errror]]
+[[Category:Synchronization and Timing Vulnerability]]
 [[Category:OWASP_CLASP_Project]]

← Older revision		Revision as of 04:08, 28 May 2006
Line 70:		Line 70:
	* [[Failure to check for certificate revocation]]		* [[Failure to check for certificate revocation]]

−	~~==Categories ==~~

	[[Category:Vulnerability]]		[[Category:Vulnerability]]

@@ Line 1: / Line 1: @@
 {{Template:SecureSoftware}}
-==Overview==
+[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
-If the revocation status of a certificate is not checked before each privilege requiring action, the system may be subject to a race condition, in which their certificate may be used before it is checked for revocation.
+Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
-==Consequences ==
+[[ASDR Table of Contents]]
-*	Integrity: Data from an untrusted (and possibly malicious) source may be integrated.
+==Description==
-*	Confidentiality: Date may be disclosed to an entity impersonating a trusted entity, resulting in information disclosure.
+If the revocation status of a certificate is not checked before each privilege requiring action, the system may be subject to a race condition, in which their certificate may be used before it is checked for revocation.
-==Exposure period ==
+'''Consequences'''
-*	Design: Checks for certificate revocation should be included in the design of a system
+* Authentication: Trust may be assigned to an entity who is not who it claims to be.
-*	Design: One can choose to use a language which abstracts out this part of the authentication process.
+'''Exposure period'''
-==Platform ==
+* Design: Checks for certificate revocation should be included in the design of a system
-*	Languages: Languages which do not abstract out this part of the process.
+'''Platform'''
-*	Operating platforms: All
+* Languages: Languages which do not abstract out this part of the process.
-==Required resources ==
+'''Required resources'''
 Minor trust: Users must attempt to interact with the malicious system.
-==Severity ==
+'''Severity'''
 Medium
-==Likelihood   of exploit ==
+'''Likelihood of exploit'''
 Medium
-==Avoidance and mitigation ==
+If a certificate is revoked after the initial check, all subsequent actions taken with the owner of the revoked certificate will loose all benefits guaranteed by the certificate. In fact, it is almost certain that the use of a revoked certificate indicates malicious activity.
-*	Design: Ensure that certificates are checked for revoked status before each use of a protected resource
+If the certificate is checked before each access of a protected resource, the delay subject to a possible race condition becomes almost negligible and significantly reduces the risk associated with this issue.
-If a certificate is revoked after the initial check, all subsequent actions taken with the owner of the revoked certificate will loose all benefits guaranteed by the certificate. In fact, it is almost certain that the use of a revoked certificate indicates malicious activity.
+==Risk Factors==
-If the certificate is checked before each access of a protected resource, the delay subject to a possible race condition becomes almost negligible and significantly reduces the risk associated with this issue.
+TBD
-==Examples ==
+==Examples==
 In C/C++:
@@ Line 60: / Line 66: @@
 </pre>
-==Related problems ==
+==Related [[Attacks]]==
-*	[[Failure to follow chain of trust in certificate validation]]
+Input Validation Vulnerability
-*	[[Failure to validate host-specific certificate data]]
+Logging and Auditing Vulnerability
-*	[[Failure to validate certificate expiration]]
+Session Management Vulnerability]]
-*	[[Failure to check for certificate revocation]]
+__NOTOC__
 [[Category:Vulnerability]]
 [[Category:Synchronization and Timing Vulnerability]]
 [[Category:OWASP_CLASP_Project]]

← Older revision		Revision as of 18:32, 16 May 2006
Line 1:		Line 1:
−
	{{Template:SecureSoftware}}		{{Template:SecureSoftware}}

Line 76:		Line 75:

	[[Category:Synchronization and Timing Errror]]		[[Category:Synchronization and Timing Errror]]
		+
		+	[[Category:OWASP_CLASP_Project]]

@@ Line 1: / Line 1: @@
 {{Template:SecureSoftware}}
@@ Line 53: / Line 52: @@
 In C/C++:
 if (!(cert = SSL_get_peer(certificate(ssl)) || !host)
    foo=SSL_get_veryify_result(ssl);
@@ Line 59: / Line 59: @@
    foo=SSL_get_veryify_result(ssl);
   //do more stuff without the check.
 ==Related problems ==
-*	Failure to follow chain of trust in certificate validation
+*	[[Failure to follow chain of trust in certificate validation]]
-*	Failure to validate host-specific certificate data
+*	[[Failure to validate host-specific certificate data]]
-*	Failure to validate certificate expiration
+*	[[Failure to validate certificate expiration]]
-*	Failure to check for certificate revocation
+*	[[Failure to check for certificate revocation]]
 ==Categories ==