|
|
|
|
CWE-147 Individual Dictionary Definition (Draft 9)
Weakness ID
| Status: Draft 147 (Weakness Variant) | | Description | Summary Terminators injected into the software through input can be used to compromise a system.
Example: a "." in SMTP signifies the end of mail message data, whereas a null character can be
used for the end of a string. | | Potential Mitigations | Developers should anticipate that terminators will be injected/removed/manipulated in
the input vectors of their software system. Use an appropriate combination of black lists and
white lists to ensure only valid, expected and appropriate input is processed by the
system. | | Observed Examples | | Reference | Description |
|---|
| CVE-2000-0319 | MFV. mail server does not properly identify terminator string to signify end of
message, causing corruption, possibly in conjunction with off-by-one error. | | CVE-2000-0320 | MFV. mail server does not properly identify terminator string to signify end of
message, causing corruption, possibly in conjunction with off-by-one error. | | CVE-2001-0996 | Mail server does not quote end-of-input terminator if it appears in the middle of a
message. | | CVE-2002-0001 | Improperly terminated comment or phrase allows commands. |
| | Relationships | | | Source Taxonomies | PLOVER - Input Terminator | | Applicable Platforms | All |
|
- Weakness
- Base
- Variant
- Class
- Chain
- Composite
- Category
- View
- Deprecated
