CWE-307 Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

• Access Control: Bypass Protection Mechanism — An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account using a brute force attack.

• [Architecture and Design] Common protection mechanisms include: • Disconnecting the user after a small number of failed attempts • Implementing a timeout • Locking out a targeted account • Requiring a computational task on the user's part. • [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

• Dynamic Analysis with Automated Results Interpretation: According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: • Web Application Scanner • Web Services Scanner • Database Scanners Cost effective for partial coverage: • Host-based Vulnerability Scanners - Examine configuration for flaws, verifying that audit mechanisms work, ensure host configuration meets certain predefined criteria • Dynamic Analysis with Manual Results Interpretation: According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: • Fuzz Tester • Framework-based Fuzzer Cost effective for partial coverage: • Forced Path Execution • Manual Static Analysis - Source Code: According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: • Focused Manual Spotcheck - Focused manual analysis of source • Manual Source Code Review (not inspections) • Automated Static Analysis - Source Code: According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: • Source code Weakness Analyzer • Context-configured Source Code Weakness Analyzer • Automated Static Analysis: According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: • Configuration Checker • Architecture or Design Review: According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: • Formal Methods / Correct-By-Construction Cost effective for partial coverage: • Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)

• CVE-2019-0039: the REST API for a network OS has a high limit for number of connections, allowing brute force password guessing • CVE-1999-1152: Product does not disconnect or timeout after multiple failed logins. • CVE-2001-1291: Product does not disconnect or timeout after multiple failed logins. • CVE-2001-0395: Product does not disconnect or timeout after multiple failed logins. • CVE-2001-1339: Product does not disconnect or timeout after multiple failed logins. • CVE-2002-0628: Product does not disconnect or timeout after multiple failed logins. • CVE-1999-1324: User accounts not disabled when they exceed a threshold; possibly a resultant problem.