CWE-494: Download of Code Without Integrity Check, page 6

Filter

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

What the weakness is: CWE-494 at MITRE

Related attack patterns (CAPEC): 12

CAPEC-184 Software Integrity Attack Severity: Low
CAPEC-185 Malicious Software Download Severity: Very High
CAPEC-186 Malicious Software Update Severity: High
CAPEC-187 Malicious Automated Software Update via Redirection Likelihood: High · Severity: High
CAPEC-533 Malicious Manual Software Update Likelihood: Low · Severity: High
CAPEC-538 Open-Source Library Manipulation Likelihood: Low · Severity: High
CAPEC-657 Malicious Automated Software Update via Spoofing Likelihood: High · Severity: High
CAPEC-662 Adversary in the Browser (AiTB) Likelihood: High · Severity: Very High
CAPEC-691 Spoof Open-Source Software Metadata Likelihood: Medium · Severity: High
CAPEC-692 Spoof Version Control System Commit Metadata Likelihood: Medium · Severity: High
CAPEC-693 StarJacking Likelihood: Medium · Severity: High
CAPEC-695 Repo Jacking Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-494, as MITRE names them. Credits.

Ask an AI about CWE-494

ChatGPT Claude Google AI Mode

Show the prompt

Explain CWE-494: Download of Code Without Integrity Check and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/494.html and https://cve.bz/cve/cwe/494?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

4.4CVE-2017-12306EPSS 0.2%2017-11-16
A vulnerability in the upgrade process of Cisco Spark Board could allow an authenticated, local attacker to install an unverified upgrade package, aka Signature Verification Bypass. The vulnerability is due to insufficient upgrade package …
8.1CVE-2017-13083EPSS 1.0%2017-10-18
Akeo Consulting Rufus prior to version 2.17.1187 does not adequately validate the integrity of updates downloaded over HTTP, allowing an attacker to easily convince a user to execute arbitrary code
–CVE-2014-2378EPSS 0.9%2014-09-05
Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not verify the integrity of downloaded updates, which allows remote attackers to execute arbitrary code via a Trojan horse update.
8.1CVE-2008-3324EPSS 1.4%2008-08-18
The PartyGaming PartyPoker client program 121/120 does not properly verify the authenticity of updates, which allows remote man-in-the-middle attackers to execute arbitrary code via a Trojan horse update.
8.1CVE-2008-3438EPSS 0.8%2008-08-01
Apple Mac OS X does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
9.8CVE-2002-0671EPSS 1.2%2002-07-23
Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the integrity of the applications, which could allow remote attackers to install Trojan horse applications …
9.8CVE-2001-1125EPSS 2.5%2001-10-05
Symantec LiveUpdate before 1.6 does not use cryptography to ensure the integrity of download files, which allows remote attackers to execute arbitrary code via DNS spoofing of the update.symantec.com site.