CWE-299 Improper Check for Certificate Revocation

The product does not check or incorrectly checks the revocation status of a certificate.

• Access Control: Gain Privileges or Assume Identity — Trust may be assigned to an untrusted entity who somehow obtained the certificate, i.e., the entity is not who it claims to be. • Integrity, Other: Other — Data from an untrusted (and possibly malicious) source may be integrated. • Confidentiality: Read Application Data — Data may be disclosed to an untrusted entity that obtained access to the certificate, thereby impersonating a trusted entity, resulting in information disclosure.

• [Architecture and Design] Ensure that certificates are checked for revoked status. • [Implementation] If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the revoked status.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2011-2014: LDAP-over-SSL implementation does not check Certificate Revocation List (CRL), allowing spoofing using a revoked certificate. • CVE-2011-0199: Operating system does not check Certificate Revocation List (CRL) in some cases, allowing spoofing using a revoked certificate. • CVE-2010-5185: Antivirus product does not check whether certificates from signed executables have been revoked. • CVE-2009-3046: Web browser does not check if any intermediate certificates are revoked. • CVE-2009-0161: Chain: Ruby module for OCSP misinterprets a response, preventing detection of a revoked certificate. • CVE-2011-2701: Chain: incorrect parsing of replies from OCSP responders allows bypass using a revoked certificate. • CVE-2011-0935: Router can permanently cache certain public keys, which would allow bypass if the certificate is later revoked. • CVE-2009-1358: Chain: OS package manager does not properly check the return value, allowing bypass using a revoked certificate. • CVE-2009-0642: Chain: language interpreter does not properly check the return value from an OSCP function, allowing bypass using a revoked certificate. • CVE-2008-4679: Chain: web service component does not call the expected method, which prevents a check for revoked certificates. • CVE-2006-4410: Certificate revocation list not searched for certain certificates. • CVE-2006-4409: Product cannot access certificate revocation list when an HTTP proxy is being used.