Threat P.W.CCCS.3

URI: P.W.CCCS.3

Package: VulnerabilityCVSS

< prev | next >

Description: Worm propagation exploit on service Service from Client: an infected client Client can send a message containing malware that without authentication, can exploit a bug in Service and infect the process.

Threat Type: Primary Threat

Matching Pattern:

P.W.CCCS.3
MP-CCCS

Finds a Client and Service with a ClientChannel between them, the Client and Service hosts and optionally the client user and the service and service host managers.

        (empty)

        (empty)

        (empty)

CSG-AntiMalwareAtServiceHost

Anti-malware software is installed on device SHost and kept up to date by regular software patches, and so can detect and prevent the execution of malicious code.

CSG-PatchingAtService

Use a systematic procedure for regular security patching of software used (including hosted process Service) on device SHost, and have a contingency plan included in the system operating policies and practices for HostManager to manually apply patches immediately for Service should the need for them become urgent.

CSG-PatchingAtService-Implementation

Represents a situation in which software patches have been applied manually by HostManager to eliminate vulnerabilities in process Service. This strategy represents activation of a contingency plan at runtime, and can be selected to discover what effect this would have on risk levels, allowing this to be used for decision support calculations. Note that this should only be considered if a suitable software patch is available. To implement this at runtime, signal the responsible user HostManager.