1057
Weaknesses related to this Pillar appear to be under-studied, especially with respect to
classification schemes. Input from academic and other communities could help identify and
resolve gaps or organizational difficulties within CWE.
Relationship
The "Interaction Error" term, in CWE and elsewhere, is only intended to describe products
that behave according to specification. When one or more of the products do not comply with
specifications, then it is more likely to be API Abuse (CWE-227) or an interpretation conflict
(CWE-436). This distinction can be blurred in real world scenarios, especially when "de facto"
standards do not comply with specifications, or when there are no standards but there is
widespread adoption. As a result, it can be difficult to distinguish these weaknesses during
mapping and classification.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Interaction Errors
References
[REF-428]Thomas H. Ptacek and Timothy N. Newsham. "Insertion, Evasion, and Denial of
Service: Eluding Network Intrusion Detection". 1998 January. < https://insecure.org/stf/secnet_ids/
secnet_ids.pdf >.2023-04-07.
[REF-568]Taimur Aslam, Ivan Krsul and Eugene H. Spafford. "Use of A Taxonomy of
Security Faults". 1995 August 1. < https://csrc.nist.gov/csrc/media/publications/conferencepaper/
1996/10/22/proceedings-of-the-19th-nissc-1996/documents/paper057/paper.pdf
>.2023-04-07.
CWE-436: Interpretation Conflict
Weakness ID : 436
Structure : Simple
Abstraction : Class
Description
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect
actions based on its perception of B's state.
Extended Description
This is generally found in proxies, firewalls, anti-virus software, and other intermediary devices that
monitor, allow, deny, or modify traffic based on how the client or server is expected to behave.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 435 Improper Interaction Between Multiple Correctly-Behaving
Entities