|
|
|
|
CWE-150 Individual Dictionary Definition (Draft 9)
Weakness ID
| Status: Incomplete 150 (Weakness Variant) | | Description | Summary Escape, meta, or control character/sequence injected into an application through input
can be used to compromise a system. as data is parsed, injected/absent/malformed escape, meta, or
control characters/sequences may cause the process to take unexpected actions that result in an
attack. | | Potential Mitigations | Developers should anticipate that escape, meta and control characters/sequences will be
injected/removed/manipulated in the input vectors of their software system. Use an appropriate
combination of black lists and white lists to ensure only valid, expected and appropriate
input is processed by the system. | | Observed Examples | | Reference | Description |
|---|
| CVE-2002-0542 | Mail program handles special "~" escape sequence even when not in interactive mode. | | CVE-2000-0703 | Setuid program does not filter escape sequences before calling mail program. | | CVE-2002-0986 | Mail function does not filter control characters from arguments, allowing mail
message content to be modified. | | CVE-2003-0020 | Multi-channel issue. Terminal escape sequences not filtered from log files. | | CVE-2003-0083 | Multi-channel issue. Terminal escape sequences not filtered from log files. | | CVE-2003-0021 | Terminal escape sequences not filtered by terminals when displaying files. | | CVE-2003-0022 | Terminal escape sequences not filtered by terminals when displaying files. | | CVE-2003-0023 | Terminal escape sequences not filtered by terminals when displaying files. | | CVE-2003-0063 | Terminal escape sequences not filtered by terminals when displaying files. | | CVE-2000-0476 | Terminal escape sequences not filtered by terminals when displaying files. | | CVE-2001-1556 | MFV. (multi-channel). Injection of control characters into log files that allow
information hiding when using raw Unix programs to read the files. |
| | Relationships | | | Source Taxonomies | PLOVER - Escape, Meta, or Control Character / Sequence | | Applicable Platforms | All | | Related Attack Patterns | | CAPEC-ID | Attack Pattern Name |
|---|
| 81 | Web Logs Tampering | | 93 | Log Injection-Tampering-Forging | | 41 | Using Meta-characters in E-mail Headers to Inject Malicious Payloads |
|
|
- Weakness
- Base
- Variant
- Class
- Chain
- Composite
- Category
- View
- Deprecated
