This Message Is From an External Sender
This message originates outside of MITRE. If you feel this is suspicious, please report it via "Report Suspicious Email" button in Outlook.
> On Jan 9, 2024, at 3:56 PM, Hatfield, Arthur <[email protected]> wrote: > > I do believe that applications, passwords, and protocols count as “resources,” and that the default configuration that ships with an application, or is engineered into a system, would count as the “initialization” of that “resource.” That said, could CWE-1188 get some better demonstrative examples? Absolutely. To wit, one of the observed examples (CVE-2022-42467) of CWE-1188 isn’t about a vulnerability at all, but about a UI not requiring a password by default. I think few people would list a password or a protocol as a "resource". If CWE-1188 is to be the generic weakness for insecure defaults, then I think it MUST be renamed from "Initialization of a Resource with an Insecure Default" to "Insecure Default". If that's the plan, the words "initialization" and "resource" are adding no value. Put another way: if everything is a resource, then there's no need to mention the word resource, as it's not distinguishing any cases. Whatever the CWE is, I'd add examples. Here are a few ideas: * By default it uses an external network connection that is NOT authenticated or encrypted. Network connections should be authenticated & encrypted (e.g., TLS, SSH, etc.). If a user specifically requests it (e.g., non-default config or "http://") that's fine, but if it's unspecified, it must be authenticated & encrypted. Protocols like telnet (port 80) should only work if the user specially configured it. * It has a default password that's known to anyone other than that specific user. it's fine for a system to request a password on startup, or have a unique password set per instance, but a default password shared among instances is insecure. * Uses a known insecure algorithm for security purposes, e.g., MD5 or SHA-1 or DES as a security mechanism. Non-security uses are fine. --- David A. Wheeler
