Interpretation Conflict
Incomplete Class
Structure: Simple
Description
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
This is generally found in proxies, firewalls, anti-virus software, and other intermediary devices that monitor, allow, deny, or modify traffic based on how the client or server is expected to behave.
Common Consequences 1
Scope: IntegrityOther
Impact: Unexpected StateVaries by Context
Demonstrative Examples 2
The paper "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection" [REF-428] shows that OSes varied widely in how they manage unusual packets, which made it difficult or impossible for intrusion detection systems to properly detect certain attacker manipulations that took advantage of these OS differences.
Null characters have different interpretations in Perl and C, which have security consequences when Perl invokes C functions. Similar problems have been reported in ASP [REF-429] and PHP.
Observed Examples 9
CVE-2005-1215Bypass filters or poison web cache using requests with multiple Content-Length headers, a non-standard behavior.
CVE-2002-0485Anti-virus product allows bypass via Content-Type and Content-Disposition headers that are mixed case, which are still processed by some clients.
CVE-2002-1978FTP clients sending a command with "PASV" in the argument can cause firewalls to misinterpret the server's error as a valid response, allowing filter bypass.
CVE-2002-1979FTP clients sending a command with "PASV" in the argument can cause firewalls to misinterpret the server's error as a valid response, allowing filter bypass.
CVE-2002-0637Virus product bypass with spaces between MIME header fields and the ":" separator, a non-standard message that is accepted by some clients.
CVE-2002-1777AV product detection bypass using inconsistency manipulation (file extension in MIME Content-Type vs. Content-Disposition field).
CVE-2005-3310CMS system allows uploads of files with GIF/JPG extensions, but if they contain HTML, Internet Explorer renders them as HTML instead of images.
CVE-2005-4260Interpretation conflict allows XSS via invalid "<" when a ">" is expected, which is treated as ">" by many web browsers.
CVE-2005-4080Interpretation conflict (non-standard behavior) enables XSS because browser ignores invalid characters in the middle of tags.
References 5
On Interpretation Conflict Vulnerabilities
Steve Christey
Bugtraq
03-11-2005
https://seclists.org/bugtraq/2005/Nov/30(2023-04-07)
ID: REF-427
Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection
Thomas H. Ptacek and Timothy N. Newsham
01-1998
ID: REF-428
0x00 vs ASP file upload scripts
Brett Moore
13-07-2004
ID: REF-429
Re: Corsaire Security Advisory - Multiple vendor MIME RFC2047 encoding
David F. Skoll
Bugtraq
15-09-2004
ID: REF-431
Perl CGI problems
Rain Forest Puppy
Phrack
09-09-1999
https://phrack.org/issues/55/7(2025-07-24)
ID: REF-514
Applicable Platforms
Languages:
Not Language-Specific : Undetermined
Modes of Introduction
Architecture and Design
Implementation
Related Attack Patterns
Related Weaknesses
Taxonomy Mapping
- PLOVER
- WASC