526
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-205: Observable Behavioral Discrepancy
Weakness ID : 205
Structure : Simple
Abstraction : Base
Description
The product's behaviors indicate important differences that may be observed by unauthorized
actors in a way that reveals (1) its internal state or decision process, or (2) differences from other
products with equivalent functionality.
Extended Description
Ideally, a product should provide as little information about its internal operations as possible.
Otherwise, attackers could use knowledge of these internal operations to simplify or optimize their
attack. In some cases, behavioral discrepancies can be used by attackers to form a side channel.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 203 Observable Discrepancy 518
ParentOf 206 Observable Internal Behavioral Discrepancy 527
ParentOf 207 Observable Behavioral Discrepancy With Equivalent
Products