CWEweakness

CWE-439 Behavioral Change in New Version or Environment

Official page ↗
Alternate terms
Functional change
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

A's behavior or functionality changes with a new version of A, or a new environment, which is not known (or manageable) by B.

Common consequences

• Other: Quality Degradation, Varies by Context

Observed examples

• CVE-2002-1976: Linux kernel 2.2 and above allow promiscuous mode using a different method than previous versions, and ifconfig is not aware of the new method (alternate path property). • CVE-2005-1711: Product uses defunct method from another product that does not return an error code and allows detection avoidance. • CVE-2003-0411: Chain: Code was ported from a case-sensitive Unix platform to a case-insensitive Windows platform where filetype handlers treat .jsp and .JSP as different extensions. JSP source code may be read because .JSP defaults to the filetype "text".

Related

Observed example · CVE (3)

  • CVE-2005-1711 Gibraltar Firewall 2.2 and earlier, when using the ClamAV update to 0.81 for Squid, uses a defunct ClamAV method to scan memory for… vulnerability
  • CVE-2003-0411 Sun ONE Application Server 7.0 for Windows 2000/XP allows remote attackers to obtain JSP source code via a request that uses the uppercase… vulnerability
  • CVE-2002-1976 ifconfig, when used on the Linux kernel 2.2 and later, does not report when the network interface is in promiscuous mode if it was put in… vulnerability

Child of · CWE (1)

  • CWE-435 Improper Interaction Between Multiple Correctly-Behaving Entities weakness