Difference between revisions of "Failure to validate certificate expiration"

From OWASP
Jump to: navigation, search
 
Line 1: Line 1:
 
  
 
{{Template:SecureSoftware}}
 
{{Template:SecureSoftware}}
Line 45: Line 44:
 
==Examples ==
 
==Examples ==
  
 +
<pre>
 
if (!(cert = SSL_get_peer(certificate(ssl)) || !host)
 
if (!(cert = SSL_get_peer(certificate(ssl)) || !host)
 
   foo=SSL_get_veryify_result(ssl);
 
   foo=SSL_get_veryify_result(ssl);
 
   if ((X509_V_OK==foo) || (X509_V_ERRCERT_NOT_YET_VALID==foo))
 
   if ((X509_V_OK==foo) || (X509_V_ERRCERT_NOT_YET_VALID==foo))
 
//do stuff  
 
//do stuff  
 +
</pre>
 +
 
==Related problems ==
 
==Related problems ==
  
* Failure to follow chain of trust in certificate validation
+
* [[Failure to follow chain of trust in certificate validation]]
  
* Failure to validate host-specific certificate data
+
* [[Failure to validate host-specific certificate data]]
  
* Key exchange without entity authentication
+
* [[Key exchange without entity authentication]]
  
* Failure to check for certificate revocation
+
* [[Failure to check for certificate revocation]]
  
* Using a key past its expiration date
+
* [[Using a key past its expiration date]]
  
 
==Categories ==
 
==Categories ==

Revision as of 11:26, 16 April 2006


Overview

The failure to validate certificate operation may result in trust being assigned to certificates which have been abandoned due to age.

Consequences

  • Integrity: The data read from the system vouched for by the expired certificate may be flawed due to malicious spoofing.
  • Authentication: Trust afforded to the system in question - based on the expired certificate - may allow for spoofing attacks.

Exposure period

  • Design: Certificate expiration handling should be performed in the design phase.

Platform

  • Languages: All
  • Platforms: All

Required resources

Minor trust: Users must attempt to interact with the malicious system.

Severity

Low

Likelihood of exploit

Low

Avoidance and mitigation

  • Design: Check for expired certificates and provide the user with adequate information about the nature of the problem and how to proceed.

Discussion

When the expiration of a certificate is not taken in to account, no trust has necessarily been conveyed through it; therefore, all benefit of certificate is lost.

Examples

if (!(cert = SSL_get_peer(certificate(ssl)) || !host)
  foo=SSL_get_veryify_result(ssl);
  if ((X509_V_OK==foo) || (X509_V_ERRCERT_NOT_YET_VALID==foo))
//do stuff 

Related problems

Categories