Insufficient Logging |
| Weakness ID: 778 (Weakness Base) | Status: Draft |
DescriptionDescription Summary
Extended Description
When security-critical events are not logged properly, such as a failed login attempt, this can make malicious behavior more difficult to detect and may hinder forensic analysis after an attack succeeds.
Time of Introduction- Operation
Applicable PlatformsLanguages
Language-independent
Common Consequences| Scope | Effect |
|---|---|
Accountability | If security critical information is not recorded, there will be no trail for forensic analysis and discovering the cause of problems or the source of attacks may become more difficult or impossible. |
Likelihood of ExploitMedium
Demonstrative ExamplesExample 1
The example below shows a configuration for the service security audit feature in the Windows Communication Foundation (WCF).
The previous configuration file has effectively disabled the recording of security-critical events, which would force the administrator to look to other sources during debug or recovery efforts.
Logging failed authentication attempts can warn administrators of potential brute force attacks. Similarly, logging successful authentication events can provide a useful audit trail when a legitimate account is compromised. The following configuration shows appropriate settings, assuming that the site does not have excessive traffic, which could fill the logs if there are a large number of success or failure events (CWE-779).
Observed Examples| Reference | Description |
|---|---|
| CVE-2008-4315 | server does not log failed authentication attempts, making it easier for attackers to perform brute force password guessing without being detected |
| CVE-2008-1203 | admin interface does not log failed authentication attempts, making it easier for attackers to perform brute force password guessing without being detected |
| CVE-2007-3730 | default configuration for POP server does not log source IP or username for login attempts |
| CVE-2007-1225 | proxy does not log requests without "http://" in the URL, allowing web surfers to access restricted web content without detection |
| CVE-2003-1566 | web server does not log requests for a non-standard request type |
Potential MitigationsPhase: Architecture and Design Use a centralized logging mechanism that supports multiple levels of detail. Ensure that all security-related successes and failures can be logged. |
Phase: Operation Be sure to set the level of logging appropriately in a production environment. Sufficient data should be logged to enable system administrators to detect attacks, diagnose errors, and recover from attacks. At the same time, logging too much data (CWE-779) can cause the same problems. |
Relationships| Nature | Type | ID | Name | View(s) this relationship pertains to |
|---|---|---|---|---|
| ChildOf |  Weakness Base | 223 | Omission of Security-relevant Information | Development Concepts (primary)699 Research Concepts (primary)1000 |
| ChildOf |  Category | 254 | Security Features | Development Concepts699 |
| ChildOf |  Weakness Class | 693 | Protection Mechanism Failure | Research Concepts1000 |
Content History| Submissions | ||||
|---|---|---|---|---|
| Submission Date | Submitter | Organization | Source | |
| 2009-07-02 | Internal CWE Team | |||
| Contributions | ||||
| Contribution Date | Contributor | Organization | Source | |
| 2009-07-02 | Fortify Software | Content | ||
| Provided code example and additional information for description and consequences. | ||||
