1068
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity
Other
Unexpected State
Varies by Context
Demonstrative Examples
Example 1:
The paper "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion
Detection" [REF-428] shows that OSes varied widely in how they manage unusual packets, which
made it difficult or impossible for intrusion detection systems to properly detect certain attacker
manipulations that took advantage of these OS differences.
Example 2:
Null characters have different interpretations in Perl and C, which have security consequences
when Perl invokes C functions. Similar problems have been reported in ASP [REF-429] and PHP.
Observed Examples
Reference Description
CVE-2005-1215 Bypass filters or poison web cache using requests with multiple Content-
Length headers, a non-standard behavior.
https://www.cve.org/CVERecord?id=CVE-2005-1215
CVE-2002-0485 Anti-virus product allows bypass via Content-Type and Content-Disposition
headers that are mixed case, which are still processed by some clients.
https://www.cve.org/CVERecord?id=CVE-2002-0485
CVE-2002-1978 FTP clients sending a command with "PASV" in the argument can cause
firewalls to misinterpret the server's error as a valid response, allowing filter
bypass.
https://www.cve.org/CVERecord?id=CVE-2002-1978
CVE-2002-1979 FTP clients sending a command with "PASV" in the argument can cause
firewalls to misinterpret the server's error as a valid response, allowing filter
bypass.
https://www.cve.org/CVERecord?id=CVE-2002-1979
CVE-2002-0637 Virus product bypass with spaces between MIME header fields and the ":"
separator, a non-standard message that is accepted by some clients.
https://www.cve.org/CVERecord?id=CVE-2002-0637
CWE Version 4.14
CWE-437: Incomplete Model of Endpoint Features
CWE-437: Incomplete Model of Endpoint Features