Improper Handling of Missing Values

Opis

The product does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing, i.e. it is empty, blank, or null.

Skutki

• Integrity

  Unexpected State

Przykłady podatności

• CVE-2002-0422 Blank Host header triggers resultant infoleak.
• CVE-2000-1006 Blank "charset" attribute in MIME header triggers crash.
• CVE-2004-1504 Blank parameter causes external error infoleak.
• CVE-2005-2053 Blank parameter causes external error infoleak.

Słabość nadrzędna

• CWE-229 Improper Handling of Values

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific

Uwagi

Some "crash by port scan" bugs are probably due to this, but lack of diagnosis makes it difficult to be certain.