{"@ID": "593", "@Name": "Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created", "@Abstraction": "Variant", "@Structure": "Simple", "@Status": "Draft", "Description": "The product modifies the SSL context after connection creation has begun.", "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "666", "@View_ID": "1000", "@Ordinal": "Primary"}, {"@Nature": "ChildOf", "@CWE_ID": "1390", "@View_ID": "1000"}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Resultant"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation", "Note": "REALIZATION: This weakness is caused during implementation of an architectural security tactic."}}, "Common_Consequences": {"Consequence": [{"Scope": "Access Control", "Impact": "Bypass Protection Mechanism", "Note": "No authentication takes place in this process, bypassing an assumed protection of encryption."}, {"Scope": "Confidentiality", "Impact": "Read Application Data", "Note": "If the program modifies the SSL_CTX object after creating SSL objects from it, there is the possibility that older SSL objects created from the original context could all be affected by that change. The encrypted communication between a user and a trusted host may be subject to a sniffing attack."}]}, "Potential_Mitigations": {"Mitigation": [{"Phase": "Architecture and Design", "Description": "Use a language or a library that provides a cryptography framework at a higher level of abstraction."}, {"Phase": "Implementation", "Description": "Most SSL_CTX functions have SSL counterparts that act on SSL-type objects."}, {"Phase": "Implementation", "Description": "Applications should set up an SSL_CTX completely, before creating SSL objects from it."}]}, "Demonstrative_Examples": {"Demonstrative_Example": {"Intro_Text": "The following example demonstrates the weakness.", "Example_Code": {"@Nature": "Bad", "@Language": "C", "xhtml:div": {"xhtml:br": [null, null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null, null, null, null, null, null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "#text": "int_error(\"Error loading certificate from file\");"}, {"@style": "margin-left:1em;", "#text": "int_error(\"Error loading private key from file\");"}, {"@style": "margin-left:1em;", "#text": "int_error(\"Error creating an SSL context\");"}, {"@style": "margin-left:1em;", "#text": "int_error(\"Doing something which is dangerous to do anyways\");"}, {"@style": "margin-left:1em;", "#text": "int_error(\"Error creating an SSL context\");"}], "#text": "SSL_CTX *ctx;SSL *ssl;init_OpenSSL();seed_prng();\n                           ctx = SSL_CTX_new(SSLv23_method());\n                           if (SSL_CTX_use_certificate_chain_file(ctx, CERT) != 1)\n                           \n                           if (SSL_CTX_use_PrivateKey_file(ctx, CERT, SSL_FILETYPE_PEM) != 1)\n                           \n                           if (!(ssl = SSL_new(ctx)))\n                           \n                           if ( SSL_CTX_set_default_passwd_cb(ctx, \"new default password\" != 1))\n                           \n                           if (!(ssl2 = SSL_new(ctx)))"}}, "#text": "#define CERT \"secret.pem\"#define CERT2 \"secret2.pem\"\n                     int main(){}"}, "#text_blocks": ["#define CERT \"secret.pem\"", "#define CERT2 \"secret2.pem\"", "int main(){", "SSL_CTX *ctx;", "SSL *ssl;", "init_OpenSSL();", "seed_prng();", "ctx = SSL_CTX_new(SSLv23_method());", "if (SSL_CTX_use_certificate_chain_file(ctx, CERT) != 1)", "int_error(\"Error loading certificate from file\");", "if (SSL_CTX_use_PrivateKey_file(ctx, CERT, SSL_FILETYPE_PEM) != 1)", "int_error(\"Error loading private key from file\");", "if (!(ssl = SSL_new(ctx)))", "int_error(\"Error creating an SSL context\");", "if ( SSL_CTX_set_default_passwd_cb(ctx, \"new default password\" != 1))", "int_error(\"Doing something which is dangerous to do anyways\");", "if (!(ssl2 = SSL_new(ctx)))", "int_error(\"Error creating an SSL context\");", "}"]}}}, "Related_Attack_Patterns": {"Related_Attack_Pattern": {"@CAPEC_ID": "94"}}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Community", "Submission_Date": "2006-12-15", "Submission_Version": "Draft 5", "Submission_ReleaseDate": "2006-12-15", "Submission_Comment": "Submitted by members of the CWE community to extend early CWE versions"}, "Modification": [{"Modification_Name": "Eric Dalci", "Modification_Organization": "Cigital", "Modification_Date": "2008-07-01", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-09-08", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Common_Consequences, Relationships, Other_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-07-27", "Modification_Version": "1.5", "Modification_ReleaseDate": "2009-07-27", "Modification_Comment": "updated Description, Other_Notes, Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-01", "Modification_Version": "1.13", "Modification_ReleaseDate": "2011-06-01", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-27", "Modification_Version": "2.0", "Modification_ReleaseDate": "2011-06-27", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-05-11", "Modification_Version": "2.2", "Modification_ReleaseDate": "2012-05-15", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-05-03", "Modification_Version": "2.11", "Modification_ReleaseDate": "2017-05-05", "Modification_Comment": "updated Potential_Mitigations, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Demonstrative_Examples, Modes_of_Introduction, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Common_Consequences, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-10-13", "Modification_Version": "4.9", "Modification_ReleaseDate": "2022-10-13", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Relationships, Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Applicable_Platforms, Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Common_Consequences, Description"}]}, "entry_type": "Weakness"}