1779
However, the attacker could supply a query string such as:
value[]=123
The "[]" array syntax causes $value to be treated as an array type, which then generates a fatal
error when calculating $sum:
Fatal error: Unsupported operand types in program.php on line 2
Example 3:
The following Perl code is intended to look up the privileges for user ID's between 0 and 3, by
performing an access of the $UserPrivilegeArray reference. It is expected that only userID 3 is an
admin (since this is listed in the third element of the array).
Example Language: Perl (Bad)
my $UserPrivilegeArray = ["user", "user", "admin", "user"];
my $userID = get_current_user_ID();
if ($UserPrivilegeArray eq "user") {
print "Regular user!\n";
}
else {
print "Admin!\n";
}
print "\$UserPrivilegeArray = $UserPrivilegeArray\n";
In this case, the programmer intended to use "$UserPrivilegeArray->{$userID}" to access the
proper position in the array. But because the subscript was omitted, the "user" string was compared
to the scalar representation of the $UserPrivilegeArray reference, which might be of the form
"ARRAY(0x229e8)" or similar.
Since the logic also "fails open" (CWE-636), the result of this bug is that all users are assigned
administrator privileges.
While this is a forced example, it demonstrates how type confusion can have security
consequences, even in memory-safe languages.
Observed Examples
Reference Description
CVE-2010-4577 Type confusion in CSS sequence leads to out-of-bounds read.
https://www.cve.org/CVERecord?id=CVE-2010-4577
CVE-2011-0611 Size inconsistency allows code execution, first discovered when it was actively
exploited in-the-wild.
https://www.cve.org/CVERecord?id=CVE-2011-0611
CVE-2010-0258 Improperly-parsed file containing records of different types leads to code
execution when a memory location is interpreted as a different object than
intended.
https://www.cve.org/CVERecord?id=CVE-2010-0258
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1157 SEI CERT C Coding Standard - Guidelines 03.
Expressions (EXP)
1154 2455
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Notes
CWE Version 4.14
CWE-862: Missing Authorization
CWE-862: Missing Authorization