Interpretation Conflict

Opis

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

This is generally found in proxies, firewalls, anti-virus software, and other intermediary devices that monitor, allow, deny, or modify traffic based on how the client or server is expected to behave.

Skutki

• Integrity, Other

  Unexpected State; Varies by Context

Przykłady podatności

• CVE-2005-1215 Bypass filters or poison web cache using requests with multiple Content-Length headers, a non-standard behavior.
• CVE-2002-0485 Anti-virus product allows bypass via Content-Type and Content-Disposition headers that are mixed case, which are still processed by some clients.
• CVE-2002-1978 FTP clients sending a command with "PASV" in the argument can cause firewalls to misinterpret the server's error as a valid response, allowing filter bypass.
• CVE-2002-1979 FTP clients sending a command with "PASV" in the argument can cause firewalls to misinterpret the server's error as a valid response, allowing filter bypass.
• CVE-2002-0637 Virus product bypass with spaces between MIME header fields and the ":" separator, a non-standard message that is accepted by some clients.
• CVE-2002-1777 AV product detection bypass using inconsistency manipulation (file extension in MIME Content-Type vs. Content-Disposition field).
• CVE-2005-3310 CMS system allows uploads of files with GIF/JPG extensions, but if they contain HTML, Internet Explorer renders them as HTML instead of images.
• CVE-2005-4260 Interpretation conflict allows XSS via invalid "<" when a ">" is expected, which is treated as ">" by many web browsers.
• CVE-2005-4080 Interpretation conflict (non-standard behavior) enables XSS because browser ignores invalid characters in the middle of tags.

Słabość nadrzędna

• CWE-435 Improper Interaction Between Multiple Correctly-Behaving Entities

Słabości podrzędne

• CWE-86 Improper Neutralization of Invalid Characters in Identifiers in Web Pages
• CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
• CWE-115 Misinterpretation of Input
• CWE-437 Incomplete Model of Endpoint Features
• CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
• CWE-626 Null Byte Interaction Error (Poison Null Byte)
• CWE-650 Trusting HTTP Permission Methods on the Server Side

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific, Not Technology-Specific

Źródła

1. On Interpretation Conflict Vulnerabilities — Steve Christey, Bugtraq, 2005
2. Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection — Thomas H. Ptacek, Timothy N. Newsham, 1998
3. 0x00 vs ASP file upload scripts — Brett Moore, 2004
4. Re: Corsaire Security Advisory - Multiple vendor MIME RFC2047 encoding — David F. Skoll, Bugtraq, 2004
5. Perl CGI problems — Rain Forest Puppy, Phrack, 1999