CWE Rule 693
Description
Rule Description
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Polyspace Implementation
The rule checker checks for Nonsecure SSL/TLS protocol.
Examples
This issue occurs when you do not
disable nonsecure protocols in an SSL_CTX
or SSL
context object before using the object for handling SSL/TLS connections.
For instance, you disable the protocols SSL2.0 and TLS1.0 but forget to disable the protocol SSL3.0, which is also considered weak.
/* Create and configure context */
ctx = SSL_CTX_new(SSLv23_method());
SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2|SSL_OP_NO_TLSv1);
/* Use context to handle connection */
ssl = SSL_new(ctx);
SSL_set_fd(ssl, NULL);
ret = SSL_connect(ssl);
The protocols SSL2.0, SSL3.0, and TLS1.0 are considered weak in the cryptographic community. Using one of these protocols can expose your connections to cross-protocol attacks. The attacker can decrypt an RSA ciphertext without knowing the RSA private key.
Disable the nonsecure protocols in the context object before using the object to handle connections.
/* Create and configure context */
ctx = SSL_CTX_new(SSLv23_method());
SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1);
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#define fatal_error() exit(-1)
int ret;
int func(){
SSL_CTX *ctx;
SSL *ssl;
SSL_library_init();
/* context configuration */
ctx = SSL_CTX_new(SSLv23_client_method());
if (ctx==NULL) fatal_error();
ret = SSL_CTX_use_certificate_file(ctx, "cert.pem", SSL_FILETYPE_PEM);
if (ret <= 0) fatal_error();
ret = SSL_CTX_load_verify_locations(ctx, NULL, "ca/path");
if (ret <= 0) fatal_error();
/* Handle connection */
ssl = SSL_new(ctx);
if (ssl==NULL) fatal_error();
SSL_set_fd(ssl, NULL);
return SSL_connect(ssl); //Noncompliant
}
In this example, the protocols SSL2.0, SSL3.0, and TLS1.0 are not disabled in the context object before the object is used for a new connection.
Disable nonsecure protocols before using the objects for a new connection. Use
the function SSL_CTX_set_options
to disable the protocols
SSL2.0, SSL3.0, and TLS1.0.
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#define fatal_error() exit(-1)
int ret;
int func(){
SSL_CTX *ctx;
SSL *ssl;
SSL_library_init();
/* context configuration */
ctx = SSL_CTX_new(SSLv23_client_method());
if (ctx==NULL) fatal_error();
SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1);
ret = SSL_CTX_use_certificate_file(ctx, "cert.pem", SSL_FILETYPE_PEM);
if (ret <= 0) fatal_error();
ret = SSL_CTX_load_verify_locations(ctx, NULL, "ca/path");
if (ret <= 0) fatal_error();
/* Handle connection */
ssl = SSL_new(ctx);
if (ssl==NULL) fatal_error();
SSL_set_fd(ssl, NULL);
return SSL_connect(ssl);
}
Check Information
Category: Others |
Version History
Introduced in R2024a
See Also
External Websites
MATLAB Command
You clicked a link that corresponds to this MATLAB command:
Run the command by entering it in the MATLAB Command Window. Web browsers do not support MATLAB commands.
Sélectionner un site web
Choisissez un site web pour accéder au contenu traduit dans votre langue (lorsqu'il est disponible) et voir les événements et les offres locales. D’après votre position, nous vous recommandons de sélectionner la région suivante : .
Vous pouvez également sélectionner un site web dans la liste suivante :
Comment optimiser les performances du site
Pour optimiser les performances du site, sélectionnez la région Chine (en chinois ou en anglais). Les sites de MathWorks pour les autres pays ne sont pas optimisés pour les visites provenant de votre région.
Amériques
- América Latina (Español)
- Canada (English)
- United States (English)
Europe
- Belgium (English)
- Denmark (English)
- Deutschland (Deutsch)
- España (Español)
- Finland (English)
- France (Français)
- Ireland (English)
- Italia (Italiano)
- Luxembourg (English)
- Netherlands (English)
- Norway (English)
- Österreich (Deutsch)
- Portugal (English)
- Sweden (English)
- Switzerland
- United Kingdom (English)