Failure to add integrity check value

Revision as of 20:13, 30 May 2009 by Deleted user (Talk | contribs)

Jump to: navigation, search

[ nortan antivirus 2005 activation key ] [ australian alps animals ] [ gay asian men videos ] [ buyers edge australia ] [ 031615976x asian exec obidos ] african bull elephant [ antivirus software for download ] [ ostrich farms in south africa ] [ antivirus software free trial ] [ ergonomics society of australia ] [ map new zealand and australia ] [ antivirus software information ] [ mdaemon antivirus keygen ] [ coorain australia ] [ is euthanasia legal in the u.s. ] alerta elephants african http [ yardley cosmetics south africa ] african american population by city [ symantic antivirus client ] url [ symantec antivirus corporate edition 10.0 2.2000 ] [ pedders australia ] [ cheap air flights south african airlines jaipur ] sonicwall complete antivirus [ pc cillin 2000 antivirus ] [ african art authenticity ] [ natural resource of south africa ] [ africaine peinture ] [ asian hong kong tv ] [ ] [ 2006 winantivirus ] [ womens golf australia ] [ just lettings south africa ] [ grisoft antivirus ] property south africa for sale [ asian chandelier ] [ gutter asian street meat ] [ auto coverage farmer insurance online proof ] steel houses australia [ autowest dodge roseville ] [ australia china flight from ] [ antivirus realtime protection failed to load ] [ africa check credit south ] [ pc cillin antivirus 11 ] [ asia booking hotel room ] [ asia manufacturer ] This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.

Last revision (mm/dd/yy): 05/30/2009

Vulnerabilities Table of Contents


If integrity check values or "checksums" are omitted from a protocol, there is no way of determining if data has been corrupted in transmission.


  • Integrity: Data that is parsed and used may be corrupted.
  • Non-repudiation: Without a checksum it is impossible to determine if any changes have been made to the data after it was sent.

Exposure period

  • Design: Checksums are an aspect of protocol design and should be handled there.
  • Implementation: Checksums must be properly created and added to the messages in the correct manner to ensure that they are correct when sent.


  • Languages: All
  • Platforms: All

Required resources

Network proximity: Some ability to inject messages into a stream, or otherwise corrupt network traffic, would be required to capitalize on this flaw.



Likelihood of exploit


The failure to include checksum functionality in a protocol removes the first application-level check of data that can be used. The end-to-end philosophy of checks states that integrity checks should be performed at the lowest level that they can be completely implemented. Excluding further sanity checks and input validation performed by applications, the protocol's checksum is the most important level of checksum, since it can be performed more completely than at any previous level and takes into account entire messages, as opposed to single packets.

Failure to add this functionality to a protocol specification, or in the implementation of that protocol, needlessly ignores a simple solution for a very significant problem and should never be skipped.

Risk Factors



In C/C++:

int r,s;
struct hostent *h;
struct sockaddr_in rserv,lserv;
memcpy((char *) &rserv.sin_addr.s_addr, h->h_addr_list[0]
rserv.sin_port= htons(1008);
s = socket(AF_INET,SOCK_DGRAM,0);

lserv.sin_family = AF_INET;
lserv.sin_addr.s_addr = htonl(INADDR_ANY);
lserv.sin_port = htons(0);

r = bind(s, (struct sockaddr *) &lserv,sizeof(lserv));
   ,(struct sockaddr *) &rserv, sizeof(rserv));

In Java:

while(true) {
  DatagramPacket rp=new DatagramPacket(rData,rData.length);
  String in = new String(p.getData(),0, rp.getLength());
  InetAddress IPAddress = rp.getAddress();
  int port = rp.getPort();
    out = secret.getBytes();
    DatagramPacket sp =new DatagramPacket(out,out.length,
      IPAddress, port);

Related Attacks

Related Vulnerabilities

Related Controls

  • Design: Add an appropriately sized checksum to the protocol, ensuring that data received may be simply validated before it is parsed and used.
  • Implementation: Ensure that the checksums present in the protocol design are properly implemented and added to each message before it is sent.

Related Technical Impacts