Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
Extended Description
This is generally found in proxies, firewalls, anti-virus software, and other intermediary devices that allow, deny, or modify traffic based on how the client or server is expected to behave.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Integrity
Other
Technical Impact: Unexpected state; Varies by context
FTP clients sending a command with "PASV" in the
argument can cause firewalls to misinterpret the server's error as a valid
response, allowing filter bypass.
FTP clients sending a command with "PASV" in the
argument can cause firewalls to misinterpret the server's error as a valid
response, allowing filter bypass.
Interpretation conflict (non-standard behavior)
enables XSS because browser ignores invalid characters in the middle of
tags.
Other Notes
The classic multiple interpretation flaws were reported in a paper that
described the limitations of intrusion detection systems. Ptacek and Newsham
(see references below) showed that OSes varied widely in their behavior with
respect to unusual network traffic, which made it difficult or impossible
for intrusion detection systems to properly detect certain attacker
manipulations that took advantage of the OS differences. Another classic
multiple interpretation error is the "poison null byte" described by Rain
Forest Puppy (see reference below), in which null characters have different
interpretations in Perl and C, which have security consequences when Perl
invokes C functions. Similar problems have been reported in ASP (see ASP
reference below) and PHP. Some of the more complex web-based attacks, such
as HTTP request smuggling, also involve multiple interpretation
errors.
A comment on a way to manage these problems is in David Skoll in the
reference below.
Manipulations are major factors in multiple interpretation errors, such as
doubling, inconsistencies between related fields, and whitespace.