CWE-437 端点特性的不完整模型

Incomplete Model of Endpoint Features

结构: Simple

Abstraction: Base

状态: Incomplete

被利用可能性: unkown

基本描述

A product acts as an intermediary or monitor between two or more endpoints, but it does not have a complete model of an endpoint's features, behaviors, or state, potentially causing the product to perform incorrect actions based on this incomplete model.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 436 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 436 cwe_View_ID: 699 cwe_Ordinal: Primary

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围	影响	注释
['Integrity', 'Other']	['Unexpected State', 'Varies by Context']

示例代码

例

HTTP request smuggling is an attack against an intermediary such as a proxy. This attack works because the proxy expects the client to parse HTTP headers one way, but the client parses them differently.

例

Anti-virus products that reside on mail servers can suffer from this issue if they do not know how a mail client will handle a particular attachment. The product might treat an attachment type as safe, not knowing that the client's configuration treats it as executable.

Notes

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
PLOVER			Extra Unhandled Features

文章来源于互联网:scap中文网