CWE-573 Improper Following of Specification by Caller

The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.

• Other: Quality Degradation, Varies by Context — Unintended behaviors may result, possibly leaving the system vulnerable to any number of exploits.

• [Implementation] When leveraging external functionality, such as an API, it is important that the caller does so in accordance with the requirements of the external functionality.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2006-7140: Crypto implementation removes padding when it shouldn't, allowing forged signatures • CVE-2006-4339: Crypto implementation removes padding when it shouldn't, allowing forged signatures