Incorrect Provision of Specified Functionality

Draft Class

Structure: Simple

Description

The code does not function according to its published specifications, potentially leading to incorrect usage.

Extended Description

When providing functionality to an external party, it is important that the product behaves in accordance with the details specified. When requirements of nuances are not documented, the functionality may produce unintended behaviors for the caller, possibly leading to an exploitable state.

Common Consequences 1

Scope: Other

Impact: Quality Degradation

Potential Mitigations 1

Phase: Implementation

Ensure that your code strictly conforms to specifications.

Demonstrative Examples 2

ID : DX-185

In the following snippet from a doPost() servlet method, the server returns "200 OK" (default) even if an error occurs.

Code Example:

Bad

Java

java

// Something that may throw an exception.* ...} catch (Throwable t) { ``` logger.error("Caught: " + t.toString()); return; }

ID : DX-186

In the following example, an HTTP 404 status code is returned in the event of an IOException encountered in a Java servlet. A 404 code is typically meant to indicate a non-existent resource and would be somewhat misleading in this case.

Code Example:

Bad

Java

java

// something that might throw IOException* ...} catch (IOException ioe) { ``` response.sendError(SC_NOT_FOUND); }

Observed Examples 4

CVE-2002-1446Error checking routine in PKCS#11 library returns "OK" status even when invalid signature is detected, allowing spoofed messages.

CVE-2001-1559Chain: System call returns wrong value (Return of Wrong Status Code), leading to a resultant NULL dereference (NULL Pointer Dereference).

CVE-2003-0187Program uses large timeouts on unconfirmed connections resulting from inconsistency in linked lists implementations.

CVE-1999-1446UI inconsistency; visited URLs list not cleared when "Clear History" option is selected.

Modes of Introduction

Implementation

Related Weaknesses

ChildOf:

Improper Adherence to Coding Standards (CWE-710)

Taxonomy Mapping

CERT C Secure Coding