Improper Following of Specification by Caller

Opis

The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.

When leveraging external functionality, such as an API, it is important that the caller does so in accordance with the requirements of the external functionality or else unintended behaviors may result, possibly leaving the system vulnerable to any number of exploits.

Skutki

• Other

  Quality Degradation; Varies by Context

Przykłady podatności

• CVE-2006-7140 Crypto implementation removes padding when it shouldn't, allowing forged signatures
• CVE-2006-4339 Crypto implementation removes padding when it shouldn't, allowing forged signatures

Słabość nadrzędna

• CWE-710 Improper Adherence to Coding Standards

Słabości podrzędne

• CWE-103 Struts: Incomplete validate() Method Definition
• CWE-104 Struts: Form Bean Does Not Extend Validation Class
• CWE-243 Creation of chroot Jail Without Changing Working Directory
• CWE-253 Incorrect Check of Function Return Value
• CWE-296 Improper Following of a Certificate's Chain of Trust
• CWE-304 Missing Critical Step in Authentication
• CWE-325 Missing Cryptographic Step
• CWE-329 Generation of Predictable IV with CBC Mode
• CWE-358 Improperly Implemented Security Check for Standard
• CWE-475 Undefined Behavior for Input to API
• CWE-568 finalize() Method Without super.finalize()
• CWE-577 EJB Bad Practices: Use of Sockets
• CWE-578 EJB Bad Practices: Use of Class Loader
• CWE-579 J2EE Bad Practices: Non-serializable Object Stored in Session
• CWE-580 clone() Method Without super.clone()
• CWE-581 Object Model Violation: Just One of Equals and Hashcode Defined
• CWE-628 Function Call with Incorrectly Specified Arguments
• CWE-675 Multiple Operations on Resource in Single-Operation Context
• CWE-694 Use of Multiple Resources with Duplicate Identifier
• CWE-695 Use of Low-Level Functionality

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific