Computer Vulnerabilities

Introduction......Page 6
Anatomy of a Vulnerability......Page 7
Vulnerability Attributes......Page 8
Severity......Page 9
Tactic......Page 10
Attributes and Vulnerabilities......Page 11
Operating System Vulnerabilities......Page 12
Network Protocol Design......Page 13
Forced Trust Violations......Page 14
“I forgot my password!”......Page 15
“What is your password?”......Page 16
Corporate Sabotage......Page 17
Extortion......Page 18
Encryption......Page 19
Secure Hashes......Page 20
People......Page 21
Recovery of Data......Page 22
Reporting of Intruders and Criminal Employees to the Proper Agencies......Page 23
Theft of Software......Page 24
Race Condition Errors......Page 25
Condition Validation Errors......Page 26
Usage of the mktemp() System Call......Page 27
Broken Logic / Failure To Catch In Regression Testing......Page 28
Setup Parameters......Page 29
Log Files with World Access......Page 30
Policy Error......Page 31
IFS Vulnerability......Page 32
Environment Variable Settings......Page 33
Environmental Fault Taxonomies......Page 34
Regular User Access......Page 36
Denial of Service......Page 37
Client Side......Page 38
Cumulative Tactics......Page 39
Authorization Required......Page 40
Interactive Shell......Page 41
One Time Execution of Code......Page 42
Reading of Any File......Page 43
Reading of a Specific Restricted File......Page 44
Overwriting Any File with Security Compromising Payload......Page 45
Overwriting Any File with Unusable Garbage......Page 46
Appending to Files......Page 47
Appending Any Files with Security Compromising Payload......Page 48
Appending Specific Files with Unusable Garbage......Page 49
Rendering a Subsystem Unusable......Page 50
Identity Modification......Page 51
Assume the Identity of User......Page 52
Assume the Identity of a Computer......Page 53
Assume the Identity of a Non-Existent Computer......Page 54
Logs Are Not Kept of Security Important Activity......Page 55
Logs Can Be Disabled......Page 56
User can view a session......Page 57
User can confirm a hidden element......Page 58
Hiding Identity......Page 59
Hiding Origin......Page 60
Environmental Consequence Taxonomy......Page 61
Object Oriented Relationships......Page 62
Appendix A:  Example EFT/ECT Document......Page 65