| 名称 |
Malicious Automated Software Update via Redirection |
|
|
| 摘要 |
An attacker exploits two layers of weaknesses in server or client software for automated update mechanisms to undermine the integrity of the target code-base. The first weakness involves a failure to properly authenticate a server as a source of update or patch content. This type of weakness typically results from authentication mechanisms which can be defeated, allowing a hostile server to satisfy the criteria that establish a trust relationship. The second weakness is a systemic failure to validate the identity and integrity of code downloaded from a remote location, hence the inability to distinguish malicious code from a legitimate update. |
| 前置条件 |
|
| 解决方案 | |
| 关联弱点 |
|
CWE 编号
|
描述
|
| CWE-494 |
Download of Code Without Integrity Check |
|
| 关联 CAPEC |
|
CAPEC 编号
|
描述
|
| CAPEC-186 |
An adversary uses deceptive methods to cause a user or an automated process to download and install dangerous code believed to be a valid update that originates from an adversary controlled source. |
|
| 分类体系：ATTACK |
|
条目编号
|
条目名称
|
| 1072 |
Software Deployment Tools |
|