Description

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Extended Description

This is generally found in proxies, firewalls, anti-virus software, and other intermediary devices that allow, deny, or modify traffic based on how the client or server is expected to behave.

Applicable Platforms
Language Class: All

Time Of Introduction

• Architecture and Design
• Implementation

Related Attack Patterns

• CAPEC-105
• CAPEC-273
• CAPEC-33

Common Consequences

Detection Methods
None

Potential Mitigations
None

Relationships

Demonstrative Examples
None

Observed Examples

1. CVE-2005-1215 : Bypass filters or poison web cache using requests with multiple Content-Length headers, a non-standard behavior.
2. CVE-2002-0485 : Anti-virus product allows bypass via Content-Type and Content-Disposition headers that are mixed case, which are still processed by some clients.
3. CVE-2002-1978 : FTP clients sending a command with "PASV" in the argument can cause firewalls to misinterpret the server's error as a valid response, allowing filter bypass.
4. CVE-2002-1979 : FTP clients sending a command with "PASV" in the argument can cause firewalls to misinterpret the server's error as a valid response, allowing filter bypass.
5. CVE-2002-0637 : Virus product bypass with spaces between MIME header fields and the ":" separator, a non-standard message that is accepted by some clients.
6. CVE-2002-1777 : AV product detection bypass using inconsistency manipulation (file extension in MIME Content-Type vs. Content-Disposition field).
7. CVE-2005-3310 : CMS system allows uploads of files with GIF/JPG extensions, but if they contain HTML, Internet Explorer renders them as HTML instead of images.
8. CVE-2005-4260 : Interpretation conflict allows XSS via invalid "<" when a ">" is expected, which is treated as ">" by many web browsers.
9. CVE-2005-4080 : Interpretation conflict (non-standard behavior) enables XSS because browser ignores invalid characters in the middle of tags.

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings

References:

1. Steve Christey .On Interpretation Conflict Vulnerabilities. Bugtraq. 2005-11-03.
2. Thomas H. Ptacek Timothy N. Newsham .Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection. Published on January 1998.
3. Brett Moore .0x00 vs ASP file upload scripts. 2004-07-13.
4. Rain Forest Puppy .Poison NULL byte. Phrack.
5. David F. Skoll .Re: Corsaire Security Advisory - Multiple vendor MIME RFC2047 encoding. Bugtraq. 2004-09-15.