diff options
Diffstat (limited to 'files/zh-cn/web/security/information_security_basics/vulnerabilities/index.html')
| -rw-r--r-- | files/zh-cn/web/security/information_security_basics/vulnerabilities/index.html | 47 |
1 files changed, 0 insertions, 47 deletions
diff --git a/files/zh-cn/web/security/information_security_basics/vulnerabilities/index.html b/files/zh-cn/web/security/information_security_basics/vulnerabilities/index.html deleted file mode 100644 index e060234976..0000000000 --- a/files/zh-cn/web/security/information_security_basics/vulnerabilities/index.html +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Vulnerabilities -slug: Web/Security/Information_Security_Basics/Vulnerabilities -translation_of: Archive/Security/Vulnerabilities ---- -<div class="summary"> -<p>本文讨论漏洞，解释它们是什么以及它们在所有系统中的存在方式。</p> -</div> - -<p>漏洞是系统中的一个弱点，可被利用来对机密性，完整性和可用性产生负面影响。 可以通过多种方式对漏洞进行分类。 本文使用三个高级漏洞类别：软件缺陷，安全配置问题和软件功能滥用。 这些类别如下所述。</p> - -<h2 id="漏洞级别">漏洞级别</h2> - -<p> </p> - -<p>软件缺陷是由软件设计或编码中的意外错误引起的。比如输入验证错误，假如用户提供的输入未正确评估恶意字符串和与已知攻击相关的过长值。另一个示例是竞争条件错误，允许攻击者使用提升的权限执行特定操作。</p> - -<p>安全配置设置是软件安全性的一个元素，可以通过软件本身进行更改。设置的示例是提供对控制列表的访问的操作系统，该控制列表设置用户对文件的特权，以及提供用于启用或禁用由应用程序存储的敏感数据的加密的设置的应用程序。安全配置问题漏洞涉及使用对软件安全性产生负面影响的安全配置设置。</p> - -<p>软件功能是由软件提供的功能功能。软件功能滥用漏洞是一种漏洞，其中该功能还提供了破坏系统安全性的途径。这些漏洞是由软件设计者做出的信任假设允许软件提供有益的功能，同时也引入某人违反信任假设以破坏安全性的可能性引起的。例如，电子邮件客户端软件可能包含在电子邮件消息中呈现HTML内容的功能。攻击者可以制作包含超链接的欺诈性电子邮件，这些超链接在以HTML格式呈现时对收件人来说是良性的，但实际上在收件人点击时会将收件人带到恶意网站。 HTML内容呈现功能设计中的一个信任假设是用户不会收到恶意超链接并点击它们。</p> - -<p>在软件设计或软件组件（例如，软件实现的协议）期间引入软件特征滥用漏洞。信任假设可能是明确的 - 例如，设计者意识到安全漏洞并确定单独的安全控制会对其进行补偿。但是，信任假设通常是隐含的，例如创建特征而不首先评估它将引入的风险。威胁也可能在软件的生命周期或软件中使用的协议中发生变化。例如，地址解析协议（ARP）信任ARP回复包含媒体访问控制（MAC）和Internet协议（IP）地址之间的正确映射。 ARP缓存使用该信息提供有用的服务 - 以便在本地网络内的设备之间发送数据。但是，攻击者可能会生成错误的ARP消息来中毒系统的ARP表，从而发起拒绝服务或中间人攻击。 ARP协议在25年前已经标准化，从那时起威胁发生了很大的变化，因此其设计中固有的信任假设今天不太可能合理。</p> - -<p>可能很难将软件功能滥用漏洞与其他两个类别区分开来。例如，软件设计过程中的缺陷可能导致软件缺陷和滥用漏洞。但是，软件缺陷纯粹是消极的 - 它们对安全性或功能没有任何积极的好处 - 而软件特性由于提供额外的功能而导致滥用漏洞。</p> - -<p>对于可以启用或禁用的功能的滥用漏洞，可能存在混淆 - 在某种程度上，配置与安全配置问题。关键的区别在于，对于滥用漏洞，配置设置启用或禁用整个功能，并不特别改变其安全性;对于安全配置问题漏洞，配置设置仅更改软件的安全性。例如，禁用电子邮件中所有HTML使用的设置会对安全性和功能产生重大影响，因此与此设置相关的漏洞将是滥用漏洞。禁用电子邮件客户端中使用反网络钓鱼功能的设置仅对安全性有重大影响，因此具有该设置的漏洞将被视为安全配置问题漏洞。</p> - -<p> </p> - -<h2 id="The_Presence_of_Vulnerabilities">The Presence of Vulnerabilities</h2> - -<p>No system is 100% secure: every system has vulnerabilities. At any given time, a system may not have any known software flaws, but security configuration issues and software feature misuse vulnerabilities are always present. Misuse vulnerabilities are inherent in software features because each feature must be based on trust assumptions—and those assumptions can be broken, albeit involving significant cost and effort in some cases. Security configuration issues are also unavoidable for two reasons. First, many configuration settings increase security at the expense of reducing functionality, so using the most secure settings could make the software useless or unusable. Second, many security settings have both positive and negative consequences for security. An example is the number of consecutive failed authentication attempts to permit before locking out a user account. Setting this to 1 would be the most secure setting against password guessing attacks, but it would also cause legitimate users to be locked out after mistyping a password once, and it would also permit attackers to perform denial-of-service attacks against users more easily by generating a single failed login attempt for each user account.</p> - -<p>Because of the number of vulnerabilities inherent in security configuration settings and software feature misuse possibilities, plus the number of software flaw vulnerabilities on a system at any given time, there may be dozens or hundreds of vulnerabilities on a single system. These vulnerabilities are likely to have a wide variety of characteristics. Some will be very easy to exploit, while others will only be exploitable under a combination of highly unlikely conditions. One vulnerability might provide root-level access to a system, while another vulnerability might only permit read access to an insignificant file. Ultimately, organizations need to know how difficult it is for someone to exploit each vulnerability and, if a vulnerability is exploited, what the possible impact would be.</p> - -<div class="originaldocinfo"> -<h3 id="Original_Document_Information" name="Original_Document_Information">Original Document Information</h3> - -<ul> - <li>Author(s): Elizabeth LeMay, Karen Scarfone, and Peter Mell</li> - <li>Title: National Institute of Standards and Technology (NIST) Interagency Report 7864, The Common Misuse Scoring System (CMSS): Metrics for Software Feature Misuse Vulnerabilities</li> - <li>Last Updated Date: July 2012</li> - <li>Copyright Information: This document is not subject to copyright.</li> -</ul> -</div> - -<p>{{QuickLinksWithSubpages("/en-US/docs/Web/Security")}}</p> |