Use of Potentially Dangerous Function

Opis

The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.

Skutki

• Other

  Varies by Context; Quality Degradation; Unexpected State

  If the function is used incorrectly, then it could result in security problems.

Zapobieganie

• Build and Compilation, Implementation

  Identify a list of prohibited API functions and prohibit developers from using these functions, providing safer alternatives. In some cases, automatic code analysis tools or the compiler can be instructed to spot use of prohibited functions, such as the "banned.h" include file from Microsoft's SDL. [REF-554] [REF-1009] [REF-7]

Przykłady podatności

• CVE-2007-1470 Library has multiple buffer overflows using sprintf() and strcpy()
• CVE-2009-3849 Buffer overflow using strcat()
• CVE-2006-2114 Buffer overflow using strcpy()
• CVE-2006-0963 Buffer overflow using strcpy()
• CVE-2011-0712 Vulnerable use of strcpy() changed to use safer strlcpy()
• CVE-2008-5005 Buffer overflow using strcpy()

Słabość nadrzędna

• CWE-1177 Use of Prohibited Code

Słabości podrzędne

• CWE-785 Use of Path Manipulation Function without Maximum-sized Buffer

Kiedy powstaje

• Implementation

Dotyczy

C, C++

Uwagi

This weakness is different than CWE-242 (Use of Inherently Dangerous Function). CWE-242 covers functions with such significant security problems that they can never be guaranteed to be safe. Some functions, if used properly, do not directly pose a security risk, but can introduce a weakness if not called correctly. These are regarded as potentially dangerous. A well-known example is the strcpy() function. When provided with a destination buffer that is larger than its source, strcpy() will not overflow. However, it is so often misused that some developers prohibit strcpy() entirely.

Źródła

1. Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors — Katrina Tsipenyuk, Brian Chess, Gary McGraw, NIST, 2005
2. Security Development Lifecycle (SDL) Banned Function Calls — Michael Howard, 2011
3. Microsoft's Free Security Tools - banned.h — Tim Rains, 2012
4. Writing Secure Code — Michael Howard, David LeBlanc, Chapter 5, "Safe String Handling" Page 156, 160, Microsoft Press, 2002
5. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 8, "C String Handling", Page 388, Addison Wesley, 2006
6. State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation — Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy, 2014