Threat CC.R.CDBSC.4

URI: CC.R.CDBSC.4

Package: VulnerabilityCVSS

< prev | next >

Description: Query injection at Service into back end DB: an attacker having exploited a bug in Service when connected to DB, is able to send arbitrary queries to DB. This is modelled as an adverse behaviour in the inferred client channel representing their trust relationship, fulfilling the precondition for further threats using injected queries to access or alter data stored by DB.

Threat Type: Primary Threat

Matching Pattern:

CC.R.CDBSC.4
MP-CDBSC

Finds a process acting as a client to a DB with a Client Channel between them, and optionally the process host manager.

        (empty)

        (empty)

        (empty)

CSG-SuspendVulnerableService

Service Service may be temporarily disabled by the manager of its host HostManager to prevent vulnerabilities being exploited by potential attackers. This strategy represents a contingency plan, which can be used to reduce risk from some threats but it may triggers other threats representing possible side effects, depending on how likely it is that the contingency plan will need to be activated.

CSG-SuspendVulnerableService-Implementation-Runtime

Service Service has been disabled by the manager of its host HostManager to prevent a known vulnerability being exploited by an attacker. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. To activate it at runtime, signal user HostManager who is responsible for managing device Host where Service is running. The Disabled Process control should be deselected only when the process has been restarted.