ByteOS Network

CWE-232:Improper Handling of Undefined Values

Weakness ID:232

Version:v4.17

Weakness Name:Improper Handling of Undefined Values

Vulnerability Mapping:Allowed

Abstraction:Variant

Structure:Simple

Status:Draft

Details Content History Observed CVE Examples Reports

▼Description

The product does not handle or incorrectly handles when a value is not defined or supported for the associated parameter, field, or argument name.

▼Relationships

Relevant to the view"Research Concepts - (1000)"

Nature	Mapping	Type	ID	Name
ChildOf	Allowed	B	229	Improper Handling of Values

Nature: ChildOf

Mapping: Allowed

Type: Base

ID: 229

Name: Improper Handling of Values

▼Memberships

Nature	Mapping	Type	ID	Name
MemberOf	Prohibited	C	851	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 8 - Exceptional Behavior (ERR)
MemberOf	Prohibited	C	993	SFP Secondary Cluster: Incorrect Input Handling
MemberOf	Prohibited	C	1407	Comprehensive Categorization: Improper Neutralization

Nature: MemberOf

Mapping: Prohibited

Type:Category

ID: 851

Name: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 8 - Exceptional Behavior (ERR)

Nature: MemberOf

Mapping: Prohibited

Type:Category

ID: 993

Name: SFP Secondary Cluster: Incorrect Input Handling

Nature: MemberOf

Mapping: Prohibited

Type:Category

ID: 1407

Name: Comprehensive Categorization: Improper Neutralization

▼Tags

Nature	Mapping	Type	ID	Name
MemberOf	Prohibited	BS	BOSS-294	Not Language-Specific Weaknesses
MemberOf	Prohibited	BS	BOSS-315	Unexpected State (impact)

Nature: MemberOf

Mapping: Prohibited

Type:BOSSView

ID: BOSS-294

Name: Not Language-Specific Weaknesses

Nature: MemberOf

Mapping: Prohibited

Type:BOSSView

ID: BOSS-315

Name: Unexpected State (impact)

▼Relevant To View

Relevant to the view"Software Fault Pattern (SFP) Clusters - (888)"

Nature	Mapping	Type	ID	Name
MemberOf	Prohibited	C	993	SFP Secondary Cluster: Incorrect Input Handling

Nature: MemberOf

Mapping: Prohibited

Type: Category

ID: 993

Name: SFP Secondary Cluster: Incorrect Input Handling

▼Common Consequences

Scope	Likelihood	Impact	Note
Integrity	N/A	Unexpected State	N/A

Scope: Integrity

Likelihood: N/A

Impact: Unexpected State

Note:

N/A

▼Modes Of Introduction

Phase: Implementation

Note:

N/A

▼Applicable Platforms

Languages

Class: Not Language-Specific(Undetermined Prevalence)

▼Demonstrative Examples

Example 1

In this example, an address parameter is read and trimmed of whitespace.

Language: Java(Bad code)

String address = request.getParameter("address"); address = address.trim(); String updateString = "UPDATE shippingInfo SET address='?' WHERE email='cwe@example.com'"; emailAddress = con.prepareStatement(updateString); emailAddress.setString(1, address);

If the value of the address parameter is null (undefined), the servlet will throw a NullPointerException when the trim() is attempted.

▼Observed Examples

Reference	Description
CVE-2000-1003	Client crash when server returns unknown driver type.

Reference: CVE-2000-1003

Description:

Client crash when server returns unknown driver type.

▼Vulnerability Mapping Notes

Usage:Allowed

Reason:Acceptable-Use

Rationale:

This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Comments:

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

▼Taxonomy Mappings

Taxonomy Name	Entry ID	Fit	Entry Name
PLOVER	N/A	N/A	Undefined Value Error
The CERT Oracle Secure Coding Standard for Java (2011)	ERR08-J	N/A	Do not catch NullPointerException or any of its ancestors

Taxonomy Name: PLOVER

Entry ID: N/A

Fit: N/A

Entry Name: Undefined Value Error

Taxonomy Name: The CERT Oracle Secure Coding Standard for Java (2011)

Entry ID: ERR08-J

Fit: N/A

Entry Name: Do not catch NullPointerException or any of its ancestors