Interpretation Conflict |
Weakness ID: 436 (Weakness Base) | Status: Incomplete |
Description Summary
Extended Description
This is generally found in proxies, firewalls, anti-virus software, and other intermediary devices that allow, deny, or modify traffic based on how the client or server is expected to behave.
Reference | Description |
---|---|
CVE-2005-1215 | Bypass filters or poison web cache using requests with multiple Content-Length headers, a non-standard behavior. |
CVE-2002-0485 | Anti-virus product allows bypass via Content-Type and Content-Disposition headers that are mixed case, which are still processed by some clients. |
CVE-2002-1978 | FTP clients sending a command with "PASV" in the argument can cause firewalls to misinterpret the server's error as a valid response, allowing filter bypass. |
CVE-2002-1979 | FTP clients sending a command with "PASV" in the argument can cause firewalls to misinterpret the server's error as a valid response, allowing filter bypass. |
CVE-2002-0637 | Virus product bypass with spaces between MIME header fields and the ":" separator, a non-standard message that is accepted by some clients. |
CVE-2002-1777 | AV product detection bypass using inconsistency manipulation (file extension in MIME Content-Type vs. Content-Disposition field). |
CVE-2005-3310 | CMS system allows uploads of files with GIF/JPG extensions, but if they contain HTML, Internet Explorer renders them as HTML instead of images. |
CVE-2005-4260 | Interpretation conflict allows XSS via invalid "<" when a ">" is expected, which is treated as ">" by many web browsers. |
CVE-2005-4080 | Interpretation conflict (non-standard behavior) enables XSS because browser ignores invalid characters in the middle of tags. |
The classic multiple interpretation flaws were reported in a paper that described the limitations of intrusion detection systems. Ptacek and Newsham (see references below) showed that OSes varied widely in their behavior with respect to unusual network traffic, which made it difficult or impossible for intrusion detection systems to properly detect certain attacker manipulations that took advantage of the OS differences. Another classic multiple interpretation error is the "poison null byte" described by Rain Forest Puppy (see reference below), in which null characters have different interpretations in Perl and C, which have security consequences when Perl invokes C functions. Similar problems have been reported in ASP (see ASP reference below) and PHP. Some of the more complex web-based attacks, such as HTTP request smuggling, also involve multiple interpretation errors. A comment on a way to manage these problems is in David Skoll in the reference below. Manipulations are major factors in multiple interpretation errors, such as doubling, inconsistencies between related fields, and whitespace. |
Nature | Type | ID | Name | View(s) this relationship pertains to![]() |
---|---|---|---|---|
ChildOf | ![]() | 435 | Interaction Error | Development Concepts (primary)699 Research Concepts (primary)1000 |
ParentOf | ![]() | 86 | Failure to Sanitize Invalid Characters in Identifiers in Web Pages | Research Concepts1000 |
ParentOf | ![]() | 115 | Misinterpretation of Input | Development Concepts (primary)699 Research Concepts (primary)1000 |
ParentOf | ![]() | 437 | Incomplete Model of Endpoint Features | Development Concepts (primary)699 Research Concepts (primary)1000 |
ParentOf | ![]() | 444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') | Research Concepts (primary)1000 |
ParentOf | ![]() | 626 | Null Byte Interaction Error (Poison Null Byte) | Development Concepts699 Research Concepts1000 |
ParentOf | ![]() | 650 | Trusting HTTP Permission Methods on the Server Side | Research Concepts (primary)1000 |
PeerOf | ![]() | 351 | Insufficient Type Distinction | Research Concepts1000 |
PeerOf | ![]() | 434 | Unrestricted Upload of File with Dangerous Type | Research Concepts1000 |
Mapped Taxonomy Name | Node ID | Fit | Mapped Node Name |
---|---|---|---|
PLOVER | Multiple Interpretation Error (MIE) | ||
WASC | 27 | HTTP Response Smuggling |
Steve Christey. "On Interpretation Conflict Vulnerabilities". Bugtraq. 2005-11-03. |
Thomas H. Ptacek and Timothy N. Newsham. "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection". January 1998. <http://www.insecure.org/stf/secnet_ids/secnet_ids.pdf>. |
Brett Moore. "0x00 vs ASP file upload scripts". 2004-07-13. <http://www.security-assessment.com/Whitepapers/0x00_vs_ASP_File_Uploads.pdf>. |
Rain Forest Puppy. "Poison NULL byte". Phrack. |
David F. Skoll. "Re: Corsaire Security Advisory - Multiple vendor MIME RFC2047 encoding". Bugtraq. 2004-09-15. <http://marc.theaimsgroup.com/?l=bugtraq&m=109525864717484&w=2>. |
Submissions | ||||
---|---|---|---|---|
Submission Date | Submitter | Organization | Source | |
PLOVER | Externally Mined | |||
Modifications | ||||
Modification Date | Modifier | Organization | Source | |
2008-07-01 | Eric Dalci | Cigital | External | |
updated Time of Introduction | ||||
2008-09-08 | CWE Content Team | MITRE | Internal | |
updated Relationships, Other Notes, Taxonomy Mappings | ||||
2008-10-14 | CWE Content Team | MITRE | Internal | |
updated Description | ||||
2009-05-27 | CWE Content Team | MITRE | Internal | |
updated Related Attack Patterns | ||||
2009-10-29 | CWE Content Team | MITRE | Internal | |
updated Relationships | ||||
Previous Entry Names | ||||
Change Date | Previous Entry Name | |||
2008-04-11 | Multiple Interpretation Error (MIE) | |||