CWE-430: Deployment of Wrong Handler
Deployment of Wrong Handler
Weakness ID: 430 (Weakness Base) Status: Incomplete
Description
Description Summary
The wrong "handler" is assigned to process an
object.
Extended Description
An example of deploying the wrong handler would be calling a servlet to
reveal source code of a .JSP file, or automatically "determining" type of
the object even if it is contradictory to an explicitly specified type.
Time of Introduction
Observed Examples
Reference Description CVE-2001-0004 Source code disclosure via manipulated file
extension that causes parsing by wrong DLL. CVE-2002-0025 Web browser does not properly handle the
Content-Type header field, causing a different application to process the
document. CVE-2000-1052 Source code disclosure by directly invoking a
servlet. CVE-2002-1742 Arbitrary Perl functions can be loaded by calling
a non-existent function that activates a
handler.
Potential Mitigations
Phase Description Perform a type check before interpreting an object.
Architecture and Design
Reject any inconsistent types, such as a file with a .GIF extension
that appears to consist of PHP code.
Weakness Ordinalities
Ordinality Description Resultant
This weakness is usually resultant from other weaknesses.
Relationships
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name PLOVER Improper Handler Deployment
Content History
Submissions Submission Date Submitter Organization Source PLOVER Externally Mined Modifications Modification Date Modifier Organization Source 2008-07-01 Eric Dalci Cigital External updated Potential Mitigations,
Time of Introduction 2008-09-08 CWE Content Team MITRE Internal updated Relationships, Other Notes,
Taxonomy Mappings 2008-10-14 CWE Content Team MITRE Internal updated Description 2009-10-29 CWE Content Team MITRE Internal updated Other Notes,
Weakness Ordinalities
Description
