CWE-358 Improperly Implemented Security Check for Standard

The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.

• Access Control: Bypass Protection Mechanism

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2002-0862: Browser does not verify Basic Constraints of a certificate, even though it is required, allowing spoofing of trusted certificates. • CVE-2002-0970: Browser does not verify Basic Constraints of a certificate, even though it is required, allowing spoofing of trusted certificates. • CVE-2002-1407: Browser does not verify Basic Constraints of a certificate, even though it is required, allowing spoofing of trusted certificates. • CVE-2005-0198: Logic error prevents some required conditions from being enforced during Challenge-Response Authentication Mechanism with MD5 (CRAM-MD5). • CVE-2004-2163: Shared secret not verified in a RADIUS response packet, allowing authentication bypass by spoofing server replies. • CVE-2005-2181: Insufficient verification in VoIP implementation, in violation of standard, allows spoofed messages. • CVE-2005-2182: Insufficient verification in VoIP implementation, in violation of standard, allows spoofed messages. • CVE-2005-2298: Security check not applied to all components, allowing bypass.