Function Call with Incorrectly Specified Arguments

Opis

The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.

There are multiple ways in which this weakness can be introduced, including:

- the wrong variable or reference;

- an incorrect number of arguments;

- incorrect order of arguments;

- wrong type of arguments; or

- wrong value.

Skutki

• Other, Access Control

  Quality Degradation; Gain Privileges or Assume Identity

  This weakness can cause unintended behavior and can lead to additional weaknesses such as allowing an attacker to gain unintended access to system resources.

Zapobieganie

• Build and Compilation

  Once found, these issues are easy to fix. Use code inspection tools and relevant compiler features to identify potential violations. Pay special attention to code that is not likely to be exercised heavily during QA.

• Architecture and Design

  Make sure your API's are stable before you use them in production code.

Przykłady podatności

• CVE-2006-7049 The method calls the functions with the wrong argument order, which allows remote attackers to bypass intended access restrictions.

Słabość nadrzędna

• CWE-573 Improper Following of Specification by Caller

Słabości podrzędne

• CWE-683 Function Call With Incorrect Order of Arguments
• CWE-685 Function Call With Incorrect Number of Arguments
• CWE-686 Function Call With Incorrect Argument Type
• CWE-687 Function Call With Incorrectly Specified Argument Value
• CWE-688 Function Call With Incorrect Variable or Reference as Argument

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific