Description

The software uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

Extended Description

If integrity check values or "checksums" are omitted from a protocol, there is no way of determining if data has been corrupted in transmission. The lack of checksum functionality in a protocol removes the first application-level check of data that can be used. The end-to-end philosophy of checks states that integrity checks should be performed at the lowest level that they can be completely implemented. Excluding further sanity checks and input validation performed by applications, the protocol's checksum is the most important level of checksum, since it can be performed more completely than at any previous level and takes into account entire messages, as opposed to single packets.

Likelihood of Exploit: Medium

Applicable Platforms
Language Class: All

Time Of Introduction

• Architecture and Design
• Implementation

Related Attack Patterns

• CAPEC-13
• CAPEC-14
• CAPEC-39
• CAPEC-74
• CAPEC-75

Common Consequences

Detection Methods
None

Potential Mitigations

Relationships

Demonstrative Examples   (Details)

1. In this example, a request packet is received, and privileged information is sent to the requester:

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings

References:

1. Michael Howard David LeBlanc John Viega .24 Deadly Sins of Software Security. McGraw-Hill. Section:'"Sin 15: Not Updating Easily." Page 231'. Published on 2010.