Interpretation ConflictID: 436 | Date: (C)2012-05-14 (M)2022-10-10 |
Type: weakness | Status: INCOMPLETE |
Abstraction Type: Base |
Description
Product A handles inputs or steps differently than Product B,
which causes A to perform incorrect actions based on its perception of B's
state.
Extended DescriptionThis is generally found in proxies, firewalls, anti-virus software, and
other intermediary devices that allow, deny, or modify traffic based on how
the client or server is expected to behave.
Applicable PlatformsLanguage Class: All
Time Of Introduction
- Architecture and Design
- Implementation
Related Attack Patterns
Common Consequences
Scope | Technical Impact | Notes |
---|
IntegrityOther | Unexpected stateVaries by context | |
Detection MethodsNone
Potential MitigationsNone
Relationships
Related CWE | Type | View | Chain |
---|
CWE-436 ChildOf CWE-902 | Category | CWE-888 | |
Demonstrative ExamplesNone
Observed Examples
- CVE-2005-1215 : Bypass filters or poison web cache using requests with multiple Content-Length headers, a non-standard behavior.
- CVE-2002-0485 : Anti-virus product allows bypass via Content-Type and Content-Disposition headers that are mixed case, which are still processed by some clients.
- CVE-2002-1978 : FTP clients sending a command with "PASV" in the argument can cause firewalls to misinterpret the server's error as a valid response, allowing filter bypass.
- CVE-2002-1979 : FTP clients sending a command with "PASV" in the argument can cause firewalls to misinterpret the server's error as a valid response, allowing filter bypass.
- CVE-2002-0637 : Virus product bypass with spaces between MIME header fields and the ":" separator, a non-standard message that is accepted by some clients.
- CVE-2002-1777 : AV product detection bypass using inconsistency manipulation (file extension in MIME Content-Type vs. Content-Disposition field).
- CVE-2005-3310 : CMS system allows uploads of files with GIF/JPG extensions, but if they contain HTML, Internet Explorer renders them as HTML instead of images.
- CVE-2005-4260 : Interpretation conflict allows XSS via invalid "<" when a ">" is expected, which is treated as ">" by many web browsers.
- CVE-2005-4080 : Interpretation conflict (non-standard behavior) enables XSS because browser ignores invalid characters in the middle of tags.
For more examples, refer to CVE relations in the bottom box.
White Box Definitions None
Black Box Definitions None
Taxynomy Mappings
Taxynomy | Id | Name | Fit |
---|
PLOVER | | Multiple Interpretation Error (MIE) | |
WASC | 27 | HTTP Response Smuggling | |
References:
- Steve Christey .On Interpretation Conflict Vulnerabilities. Bugtraq. 2005-11-03.
- Thomas H. Ptacek Timothy N. Newsham .Insertion, Evasion, and Denial of Service: Eluding Network
Intrusion Detection. Published on January 1998.
- Brett Moore .0x00 vs ASP file upload scripts. 2004-07-13.
- Rain Forest Puppy .Poison NULL byte. Phrack.
- David F. Skoll .Re: Corsaire Security Advisory - Multiple vendor MIME RFC2047
encoding. Bugtraq. 2004-09-15.