Red Hat Security Advisory: RHTAS 1.5.1 - Red Hat Trusted Artifact Signer Release

1. Implementation

   For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.

2. Requirements

   Select a programming language that is not susceptible to these issues.

3. Implementation

   Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

OWASP Cheat Sheets

• Logging (opens in a new tab)
• Error Handling (opens in a new tab)

OWASP ASVS 4.0.3

• V11.1.7 (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Operation

   If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.

2. Implementation

   Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.

OWASP Cheat Sheets

• File Upload (opens in a new tab)

OWASP ASVS 4.0.3

• V12.1.1 (opens in a new tab)

Attack patterns

• Exponential Data Expansion (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation

   If the assertion statement is required (e.g., for security or reliability), change the invoking code to avoid the conditions that trigger the assertion.

2. Implementation

   Consider changing the assertion to some other less "fatal" error. This might not be easy to implement, since other code may be needed to handle the error.

3. Implementation

   Make sensitive open/close operations non-reachable from directly user-controlled data (e.g. open/close resources)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Requirements

   The choice between a language which has named or unnamed exceptions needs to be done. While unnamed exceptions exacerbate the chance of not properly dealing with an exception, named exceptions suffer from the up call version of the weak base class problem.

2. Requirements

   A language can be used which requires, at compile time, to catch all serious exceptions. However, one must make sure to use the most current version of the API as new exceptions could be added.

3. Implementation

   Catch all relevant exceptions. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.

OWASP Cheat Sheets

• Logging (opens in a new tab)
• Error Handling (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Architecture and Design · Implementation

   Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.

2. Implementation

   If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.

OWASP Cheat Sheets

• Transport Layer Protection (opens in a new tab)
• TLS Cipher String (opens in a new tab)
• OWASP Authentication (opens in a new tab)

OWASP ASVS 4.0.3

• V9.2.1 (opens in a new tab)
• V1.9.2 (opens in a new tab)
• V2.8.5 (opens in a new tab)

Attack patterns

• Creating a Rogue Certification Authority Certificate (opens in a new tab)
• Signature Spoofing by Improper Validation (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

OWASP Cheat Sheets

• OWASP Authentication (opens in a new tab)

OWASP ASVS 4.0.3

• V14.5.2 (opens in a new tab)
• V14.5.3 (opens in a new tab)
• V1.4.4 (opens in a new tab)

Attack patterns

• JSON Hijacking (aka JavaScript Hijacking) (opens in a new tab)
• Cache Poisoning (opens in a new tab)
• DNS Cache Poisoning (opens in a new tab)
• Exploit Script-Based APIs (opens in a new tab)
• Application API Message Manipulation via Man-in-the-Middle (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Implementation

   The protocol specification describes the algorithm used for calculating the checksum. It is then a matter of implementing the calculation and verifying that the calculated checksum and the received checksum match.

OWASP Cheat Sheets

• XML Security (opens in a new tab)
• REST Security (opens in a new tab)
• JSON Web Token for Java (opens in a new tab)

OWASP ASVS 4.0.3

• V11.1.7 (opens in a new tab)
• V13.3.2 (opens in a new tab)
• V3.5.3 (opens in a new tab)

Attack patterns

• Checksum Spoofing (opens in a new tab)
• Padding Oracle Crypto Attack (opens in a new tab)
• Manipulating Writeable Configuration Files (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

1. Requirements

   Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.

2. Architecture and Design

   Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

3. Architecture and Design

   Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.

OWASP Cheat Sheets

• Abuse Case (opens in a new tab)

OWASP ASVS 4.0.3

• V8.1.4 (opens in a new tab)
• V13.4.1 (opens in a new tab)
• V11.1.4 (opens in a new tab)

Attack patterns

• XML Ping of the Death (opens in a new tab)
• Exponential Data Expansion (opens in a new tab)
• Serialized Data Parameter Blowup (opens in a new tab)
• Serialized Data with Nested Payloads (opens in a new tab)
• Oversized Serialized Data Payloads (opens in a new tab)

From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).