CWE-436 解释冲突

Interpretation Conflict

结构: Simple

Abstraction: Class

状态: Incomplete

被利用可能性: unkown

基本描述

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

扩展描述

This is generally found in proxies, firewalls, anti-virus software, and other intermediary devices that monitor, allow, deny, or modify traffic based on how the client or server is expected to behave.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 435 cwe_View_ID: 1000 cwe_Ordinal: Primary

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围	影响	注释
['Integrity', 'Other']	['Unexpected State', 'Varies by Context']

示例代码

例

The paper "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection" [REF-428] shows that OSes varied widely in how they manage unusual packets, which made it difficult or impossible for intrusion detection systems to properly detect certain attacker manipulations that took advantage of these OS differences.

例

Null characters have different interpretations in Perl and C, which have security consequences when Perl invokes C functions. Similar problems have been reported in ASP [REF-429] and PHP.

分析过的案例

标识	说明	链接
CVE-2005-1215	Bypass filters or poison web cache using requests with multiple Content-Length headers, a non-standard behavior.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1215
CVE-2002-0485	Anti-virus product allows bypass via Content-Type and Content-Disposition headers that are mixed case, which are still processed by some clients.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0485
CVE-2002-1978	FTP clients sending a command with "PASV" in the argument can cause firewalls to misinterpret the server's error as a valid response, allowing filter bypass.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1978
CVE-2002-1979	FTP clients sending a command with "PASV" in the argument can cause firewalls to misinterpret the server's error as a valid response, allowing filter bypass.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1979
CVE-2002-0637	Virus product bypass with spaces between MIME header fields and the ":" separator, a non-standard message that is accepted by some clients.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0637
CVE-2002-1777	AV product detection bypass using inconsistency manipulation (file extension in MIME Content-Type vs. Content-Disposition field).	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1777
CVE-2005-3310	CMS system allows uploads of files with GIF/JPG extensions, but if they contain HTML, Internet Explorer renders them as HTML instead of images.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3310
CVE-2005-4260	Interpretation conflict allows XSS via invalid "" is expected, which is treated as ">" by many web browsers.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4260
CVE-2005-4080	Interpretation conflict (non-standard behavior) enables XSS because browser ignores invalid characters in the middle of tags.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4080

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
PLOVER			Multiple Interpretation Error (MIE)
WASC	27		HTTP Response Smuggling

相关攻击模式

• CAPEC-105
• CAPEC-273
• CAPEC-33

引用

• REF-427 On Interpretation Conflict Vulnerabilities

• REF-428 Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection

• REF-429 0x00 vs ASP file upload scripts

• REF-430 Poison NULL byte

• REF-431 Re: Corsaire Security Advisory - Multiple vendor MIME RFC2047 encoding

文章来源于互联网:scap中文网