CWE-241
Improper Handling of Unexpected Data Type
2006-07-19
00h00 +00:00
00h00 +00:00
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Tên: Improper Handling of Unexpected Data Type
The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).
Thông tin chung
Các cách xuất hiện
ImplementationNền tảng áp dụng
Ngôn ngữ
Lớp: Not Language-Specific (Undetermined)Hậu quả phổ biến
| Phạm vi | Tác động | Khả năng xảy ra |
|---|---|---|
| Integrity Other | Varies by Context, Unexpected State |
Ví dụ đã quan sát
| Tài liệu tham khảo | Mô tả |
|---|---|
CVE-1999-1156 | FTP server crash via PORT command with non-numeric character. |
CVE-2004-0270 | Anti-virus product has an assertion error when the line length is non-numeric. |
Các biện pháp giảm thiểu tiềm năng
Phases : ImplementationPhases : Implementation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Ghi chú ánh xạ lỗ hổng
Lý do : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Mẫu tấn công liên quan
| ID CAPEC | Tên mẫu tấn công |
|---|---|
| CAPEC-48 | Passing Local Filenames to Functions That Expect a URL
This attack relies on client side code to access local files and resources instead of URLs. When the client browser is expecting a URL string, but instead receives a request for a local file, that execution is likely to occur in the browser process space with the browser's authority to local files. The attacker can send the results of this request to the local files out to a site that they control. This attack may be used to steal sensitive authentication data (either local or remote), or to gain system profile information to launch further attacks. |
Ghi chú
Probably under-studied.Gửi
| Tên | Tổ chức | Ngày | Ngày phát hành | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
Sửa đổi
| Tên | Tổ chức | Ngày | Bình luận |
|---|---|---|---|
| Eric Dalci | Cigital | updated Potential_Mitigations, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Description, Name | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Applicable_Platforms, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations, Relationships | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Relationships, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Observed_Examples |
