The product does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing, i.e. it is empty, blank, or null.
N/A
Threat Mapped score: 0.0
Industry: Finiancial
Threat priority: Unclassified
CVE: CVE-2002-0422
Blank Host header triggers resultant infoleak.
CVE: CVE-2000-1006
Blank "charset" attribute in MIME header triggers crash.
CVE: CVE-2004-1504
Blank parameter causes external error infoleak.
CVE: CVE-2005-2053
Blank parameter causes external error infoleak.
N/A
N/A
| Phase | Note |
|---|---|
| Implementation | N/A |
Intro: This Android application has registered to handle a URL when sent an intent:
Body: The application assumes the URL will always be included in the intent. When the URL is not present, the call to getStringExtra() will return null, thus causing a null pointer exception when length() is called.
... IntentFilter filter = new IntentFilter("com.example.URLHandler.openURL"); MyReceiver receiver = new MyReceiver(); registerReceiver(receiver, filter); ... public class UrlHandlerReceiver extends BroadcastReceiver { @Override public void onReceive(Context context, Intent intent) { if("com.example.URLHandler.openURL".equals(intent.getAction())) { String URL = intent.getStringExtra("URLToOpen"); int length = URL.length(); ... } } }