Common Weakness Enumeration

A Community-Developed List of Software Weakness Types

CWE/SANS Top 25 Most Dangerous Software Errors
Home > CWE List > CWE- Individual Dictionary Definition (2.11)  

CWE-436: Interpretation Conflict

Weakness ID: 436
Abstraction: Base
Status: Incomplete
Presentation Filter:
+ Description

Description Summary

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Extended Description

This is generally found in proxies, firewalls, anti-virus software, and other intermediary devices that monitor, allow, deny, or modify traffic based on how the client or server is expected to behave.

+ Time of Introduction
  • Architecture and Design
  • Implementation
+ Applicable Platforms



+ Common Consequences

Technical Impact: Unexpected state; Varies by context

+ Observed Examples
Bypass filters or poison web cache using requests with multiple Content-Length headers, a non-standard behavior.
Anti-virus product allows bypass via Content-Type and Content-Disposition headers that are mixed case, which are still processed by some clients.
FTP clients sending a command with "PASV" in the argument can cause firewalls to misinterpret the server's error as a valid response, allowing filter bypass.
FTP clients sending a command with "PASV" in the argument can cause firewalls to misinterpret the server's error as a valid response, allowing filter bypass.
Virus product bypass with spaces between MIME header fields and the ":" separator, a non-standard message that is accepted by some clients.
AV product detection bypass using inconsistency manipulation (file extension in MIME Content-Type vs. Content-Disposition field).
CMS system allows uploads of files with GIF/JPG extensions, but if they contain HTML, Internet Explorer renders them as HTML instead of images.
Interpretation conflict allows XSS via invalid "<" when a ">" is expected, which is treated as ">" by many web browsers.
Interpretation conflict (non-standard behavior) enables XSS because browser ignores invalid characters in the middle of tags.
White paper: showed that OSes varied widely in how they manage unusual packets, which made it difficult or impossible for intrusion detection systems to properly detect certain attacker manipulations that took advantage of these OS differences.
"poison null byte" example - null characters have different interpretations in Perl and C, which have security consequences when Perl invokes C functions. Similar problems have been reported in ASP [R.436.3] and PHP.
+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness ClassWeakness Class435Interaction Error
Development Concepts (primary)699
Research Concepts (primary)1000
Weaknesses for Simplified Mapping of Published Vulnerabilities (primary)1003
ChildOfCategoryCategory957SFP Secondary Cluster: Protocol Error
Software Fault Pattern (SFP) Clusters (primary)888
ParentOfWeakness VariantWeakness Variant86Improper Neutralization of Invalid Characters in Identifiers in Web Pages
Research Concepts1000
ParentOfWeakness BaseWeakness Base115Misinterpretation of Input
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness Base437Incomplete Model of Endpoint Features
Development Concepts (primary)699
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness Base444Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Research Concepts (primary)1000
Weaknesses for Simplified Mapping of Published Vulnerabilities (primary)1003
ParentOfWeakness VariantWeakness Variant626Null Byte Interaction Error (Poison Null Byte)
Development Concepts699
Research Concepts1000
ParentOfWeakness VariantWeakness Variant650Trusting HTTP Permission Methods on the Server Side
Development Concepts (primary)699
Research Concepts (primary)1000
PeerOfWeakness BaseWeakness Base351Insufficient Type Distinction
Research Concepts1000
PeerOfWeakness BaseWeakness Base434Unrestricted Upload of File with Dangerous Type
Research Concepts1000
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
PLOVERMultiple Interpretation Error (MIE)
WASC27HTTP Response Smuggling
+ References
[R.436.1] Steve Christey. "On Interpretation Conflict Vulnerabilities". Bugtraq. 2005-11-03.
[R.436.2] Thomas H. Ptacek and Timothy N. Newsham. "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection". January 1998. <>.
[R.436.3] Brett Moore. "0x00 vs ASP file upload scripts". 2004-07-13. <>.
[R.436.4] Rain Forest Puppy. "Poison NULL byte". Phrack.
[R.436.5] David F. Skoll. "Re: Corsaire Security Advisory - Multiple vendor MIME RFC2047 encoding". Bugtraq. 2004-09-15. <>.
+ Content History
Submission DateSubmitterOrganizationSource
PLOVERExternally Mined
Modification DateModifierOrganizationSource
2008-07-01Eric DalciCigitalExternal
updated Time_of_Introduction
2008-09-08CWE Content TeamMITREInternal
updated Relationships, Other_Notes, Taxonomy_Mappings
2008-10-14CWE Content TeamMITREInternal
updated Description
2009-05-27CWE Content TeamMITREInternal
updated Related_Attack_Patterns
2009-10-29CWE Content TeamMITREInternal
updated Relationships
2010-02-16CWE Content TeamMITREInternal
updated Relationships, Taxonomy_Mappings
2010-04-05CWE Content TeamMITREInternal
updated Related_Attack_Patterns
2011-06-01CWE Content TeamMITREInternal
updated Common_Consequences
2011-06-27CWE Content TeamMITREInternal
updated Common_Consequences
2012-05-11CWE Content TeamMITREInternal
updated Relationships
2014-06-23CWE Content TeamMITREInternal
updated Applicable_Platforms, Description, Observed_Examples, Other_Notes, References
2014-07-30CWE Content TeamMITREInternal
updated Relationships
2015-12-07CWE Content TeamMITREInternal
updated Relationships
2017-01-19CWE Content TeamMITREInternal
updated Relationships
Previous Entry Names
Change DatePrevious Entry Name
2008-04-11Multiple Interpretation Error (MIE)

More information is available — Please select a different filter.
Page Last Updated: May 05, 2017