ByteOS Network

CWE-439:Behavioral Change in New Version or Environment

Weakness ID:439

Version:v4.17

Weakness Name:Behavioral Change in New Version or Environment

Vulnerability Mapping:Allowed

Abstraction:Base

Structure:Simple

Status:Draft

Details Content History Observed CVE Examples Reports

▼Description

A's behavior or functionality changes with a new version of A, or a new environment, which is not known (or manageable) by B.

▼Alternate Terms

Functional change

▼Relationships

Relevant to the view"Research Concepts - (1000)"

Nature	Mapping	Type	ID	Name
ChildOf	Discouraged	P	435	Improper Interaction Between Multiple Correctly-Behaving Entities

Nature: ChildOf

Mapping: Discouraged

Type: Pillar

ID: 435

Name: Improper Interaction Between Multiple Correctly-Behaving Entities

▼Memberships

Nature	Mapping	Type	ID	Name
MemberOf	Prohibited	C	438	Behavioral Problems
MemberOf	Prohibited	C	1001	SFP Secondary Cluster: Use of an Improper API
MemberOf	Prohibited	C	1398	Comprehensive Categorization: Component Interaction

Nature: MemberOf

Mapping: Prohibited

Type:Category

ID: 438

Name: Behavioral Problems

Nature: MemberOf

Mapping: Prohibited

Type:Category

ID: 1001

Name: SFP Secondary Cluster: Use of an Improper API

Nature: MemberOf

Mapping: Prohibited

Type:Category

ID: 1398

Name: Comprehensive Categorization: Component Interaction

▼Tags

Nature	Mapping	Type	ID	Name
MemberOf	Prohibited	BS	BOSS-294	Not Language-Specific Weaknesses
MemberOf	Prohibited	BS	BOSS-325	Quality Degradation (impact)
MemberOf	Prohibited	BS	BOSS-326	Varies by Context (impact)

Nature: MemberOf

Mapping: Prohibited

Type:BOSSView

ID: BOSS-294

Name: Not Language-Specific Weaknesses

Nature: MemberOf

Mapping: Prohibited

Type:BOSSView

ID: BOSS-325

Name: Quality Degradation (impact)

Nature: MemberOf

Mapping: Prohibited

Type:BOSSView

ID: BOSS-326

Name: Varies by Context (impact)

▼Relevant To View

Relevant to the view"Software Development - (699)"

Nature	Mapping	Type	ID	Name
MemberOf	Prohibited	C	438	Behavioral Problems

Nature: MemberOf

Mapping: Prohibited

Type: Category

ID: 438

Name: Behavioral Problems

Relevant to the view"Software Fault Pattern (SFP) Clusters - (888)"

Nature	Mapping	Type	ID	Name
MemberOf	Prohibited	C	1001	SFP Secondary Cluster: Use of an Improper API

Nature: MemberOf

Mapping: Prohibited

Type: Category

ID: 1001

Name: SFP Secondary Cluster: Use of an Improper API

▼Common Consequences

Scope	Likelihood	Impact	Note
Other	N/A	Quality DegradationVaries by Context	N/A

Scope: Other

Likelihood: N/A

Impact: Quality Degradation, Varies by Context

Note:

N/A

▼Modes Of Introduction

Phase: Architecture and Design

Note:

N/A

Phase: Implementation

Note:

N/A

▼Applicable Platforms

Languages

Class: Not Language-Specific(Undetermined Prevalence)

▼Observed Examples

Reference	Description
CVE-2002-1976	Linux kernel 2.2 and above allow promiscuous mode using a different method than previous versions, and ifconfig is not aware of the new method (alternate path property).
CVE-2005-1711	Product uses defunct method from another product that does not return an error code and allows detection avoidance.
CVE-2003-0411	chain: Code was ported from a case-sensitive Unix platform to a case-insensitive Windows platform where filetype handlers treat .jsp and .JSP as different extensions. JSP source code may be read because .JSP defaults to the filetype "text".

Reference: CVE-2002-1976

Description:

Linux kernel 2.2 and above allow promiscuous mode using a different method than previous versions, and ifconfig is not aware of the new method (alternate path property).

Reference: CVE-2005-1711

Description:

Product uses defunct method from another product that does not return an error code and allows detection avoidance.

Reference: CVE-2003-0411

Description:

chain: Code was ported from a case-sensitive Unix platform to a case-insensitive Windows platform where filetype handlers treat .jsp and .JSP as different extensions. JSP source code may be read because .JSP defaults to the filetype "text".

▼Vulnerability Mapping Notes

Usage:Allowed

Reason:Acceptable-Use

Rationale:

This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Comments:

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

▼Taxonomy Mappings

Taxonomy Name	Entry ID	Fit	Entry Name
PLOVER	N/A	N/A	CHANGE Behavioral Change

Taxonomy Name: PLOVER

Entry ID: N/A

Fit: N/A

Entry Name: CHANGE Behavioral Change