Page History

MSC18-C

Medium

Probable

No

MediumNo

P8P4

L2L3

HARDCODED.AUTH

HARDCODED.KEY

HARDCODED.SALT

MISC.PWD.PLAIN

MISC.PWD.PLAINTRAN

Hardcoded Authentication

Hardcoded Crypto Key

Hardcoded Crypto Salt

Plaintext Storage of Password

Plaintext Transmission of Password

C3556
C3557
C3558

586

Partially supported: reports functions that read passwords from the user or that take a password as an argument instead of prompting the user as well as insecure password erasure

CERT C: Rec. MSC18-C

Checks for:

• Constant or predictable block cipher initialization vector
• Constant or predictable cipher key
• Sensitive heap memory not cleared before release
• Uncleared sensitive data in stack
• Unsafe standard encryption function

Sensitive data not cleared or released by memory routine

Variable in stack is not cleared and contains sensitive data

Function is not reentrant or uses a risky encryption algorithm

Encryption or decryption key is constant instead of randomized or  generated from a weak random number generator

Initialization vector is constant instead of randomized

Encryption or decryption key is generated from a weak random number generator

Initialization vector is generated from a weak random number generator

Rec. partially covered.

CsFPC

Fully implemented