C and C++ Binaries

MISC.PWD.PLAINTRAN : Plaintext Transmission of Password

Summary

A password is transmitted without encryption, then subsequently used for authentication.

Properties

Class Name Plaintext Transmission of Password
Significance security
Mnemonic MISC.PWD.PLAINTRAN
Categories
CWE CWE:311 Missing Encryption of Sensitive Data
  CWE:319 Cleartext Transmission of Sensitive Information
CERT-C CERT-C:MSC18-C Be careful while handling sensitive data, such as passwords, in program code
DISA-6r1 DISA-6r1:V-222542 The application must only store cryptographic representations of passwords.
  DISA-6r1:V-222543 The application must transmit only cryptographically-protected passwords.
DISA-5r3 DISA-5r3:V-69567 The application must only store cryptographic representations of passwords.
  DISA-5r3:V-69569 The application must transmit only cryptographically-protected passwords.
DISA-4r3 DISA-4r3:V-69567 The application must only store cryptographic representations of passwords.
  DISA-4r3:V-69569 The application must transmit only cryptographically-protected passwords.
DISA-3r10 DISA-3r10:V-16796 The designer will ensure the application transmits account passwords in an approved encrypted format.
  DISA-3r10:V-16797 The designer will ensure the application stores account passwords in an approved encrypted format.
Availability Available for C and C++.
Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file. 
WARNING_FILTER += discard class="Plaintext Transmission of Password"

Example 

#include <windows.h>
#include <sys/socket.h>
#include <sql.h>
#include <sqlext.h>
#include <sqltypes.h>

int misc_pwd_plaintran(SQLCHAR *server_name, int sock ){
    RETCODE rc;
    HENV henv;
    HDBC hdbc;
    HSTMT hstmt;
    SQLCHAR uname[16];
    SQLCHAR passwd[32];

    if (recv(sock, uname, 16, 0) <= 0 ) return -1;
    if (recv(sock, passwd, 32, 0) <= 0 ) return -1;

    SQLAllocEnv(&henv);
    SQLAllocConnect(henv, &hdbc);
    if( !hdbc ) abort();
    rc = SQLConnectA(hdbc, /* "Plaintext Transmission of Password" warning issued here */
                     server_name, SQL_NTS,
                     uname, 16,
                     passwd, 32);
    /* remainder of function */
    exit(0);
}

Note that if the password argument to SQLConnectA() were specified as a literal string in the file (rather than being retrieved from a socket), CodeSonar would issue a Hardcoded Authentication warning instead.

Triggers

CodeSonar ships with library models that allow it to recognize functions such as Win32 LogonUserA()/LogonUserW() that can use a password for authentication. If one of these functions is called with a potentially-cleartext-transmitted value in the password parameter position, a warning will be issued.

If you have created a custom library model for some function f() in terms of one of these existing models, calls to f() will also be capable of triggering Plaintext Transmission of Password warnings.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.