The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
View on MITREIf integrity check values or "checksums" are omitted from a protocol, there is no way of determining if data has been corrupted in transmission. The lack of checksum functionality in a protocol removes the first application-level check of data that can be used. The end-to-end philosophy of checks states that integrity checks should be performed at the lowest level that they can be completely implemented. Excluding further sanity checks and input validation performed by applications, the protocol's checksum is the most important level of checksum, since it can be performed more completely than at any previous level and takes into account entire messages, as opposed to single packets.
Data that is parsed and used may be corrupted.
Without a checksum it is impossible to determine if any changes have been made to the data after it was sent.
Add an appropriately sized checksum to the protocol, ensuring that data received may be simply validated before it is parsed and used.
Ensure that the checksums present in the protocol design are properly implemented and added to each message before it is sent.
No detection method information available for this CWE.
In this example, a request packet is received, and privileged information is sent to the requester:
The response containing secret data has no integrity check associated with it, allowing an attacker to alter the message without detection.
CWE-353: Missing Support for Integrity Check is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum. If integrity check values or "checksums" are omitted from a protocol, there is no way of determining if data has been corrupted in transmission. The lack of checksum functionality in a protocol removes the first application-level check of data that can be used. The end-to-end philosophy of checks states that integrity checks should be performed at the lowest level that they can be completely implemented. Excluding further sanity checks and input validation performed by applications, the protocol's checksum is the most important level of checksum, since it can be performed more completely than at any previous level and takes into account entire messages, as opposed to single packets.
If exploited, CWE-353 (Missing Support for Integrity Check) it can compromise Integrity, Other and Non-Repudiation, leading to outcomes such as Other and Hide Activities.
Recommended mitigations for CWE-353 include: Add an appropriately sized checksum to the protocol, ensuring that data received may be simply validated before it is parsed and used. Ensure that the checksums present in the protocol design are properly implemented and added to each message before it is sent.
CWE-353 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
A CWE (Common Weakness Enumeration) like CWE-353 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.