Incorrect Provision of Specified Functionality

Opis

The code does not function according to its published specifications, potentially leading to incorrect usage.

When providing functionality to an external party, it is important that the product behaves in accordance with the details specified. When requirements of nuances are not documented, the functionality may produce unintended behaviors for the caller, possibly leading to an exploitable state.

Skutki

• Other

  Quality Degradation

Zapobieganie

• Implementation

  Ensure that your code strictly conforms to specifications.

Przykłady podatności

• CVE-2002-1446 Error checking routine in PKCS#11 library returns "OK" status even when invalid signature is detected, allowing spoofed messages.
• CVE-2001-1559 Chain: System call returns wrong value (CWE-393), leading to a resultant NULL dereference (CWE-476).
• CVE-2003-0187 Program uses large timeouts on unconfirmed connections resulting from inconsistency in linked lists implementations.
• CVE-1999-1446 UI inconsistency; visited URLs list not cleared when "Clear History" option is selected.

Słabość nadrzędna

• CWE-710 Improper Adherence to Coding Standards

Słabości podrzędne

• CWE-392 Missing Report of Error Condition
• CWE-393 Return of Wrong Status Code
• CWE-440 Expected Behavior Violation
• CWE-446 UI Discrepancy for Security Feature
• CWE-451 User Interface (UI) Misrepresentation of Critical Information
• CWE-912 Hidden Functionality
• CWE-1245 Improper Finite State Machines (FSMs) in Hardware Logic

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific