CERT C Secure Coding Standard (2008) Appendix - POSIX (POS)

Opis

Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) appendix of the CERT C Secure Coding Standard (2008).

Wpisy w tej grupie

• CWE-170 Improper Null Termination
• CWE-242 Use of Inherently Dangerous Function
• CWE-272 Least Privilege Violation
• CWE-273 Improper Check for Dropped Privileges
• CWE-363 Race Condition Enabling Link Following
• CWE-366 Race Condition within a Thread
• CWE-562 Return of Stack Variable Address
• CWE-59 Improper Link Resolution Before File Access ('Link Following')
• CWE-667 Improper Locking
• CWE-686 Function Call With Incorrect Argument Type
• CWE-696 Incorrect Behavior Order

Uwagi

<xhtml:p>In the 2008 version of the CERT C Secure Coding standard, the following rules were mapped to the following CWE IDs:</xhtml:p> <xhtml:ul> <xhtml:li>CWE-59 POS01-C Check for the existence of links when dealing with files</xhtml:li> <xhtml:li>CWE-170 POS30-C Use the readlink() function properly</xhtml:li> <xhtml:li>CWE-242 POS33-C Do not use vfork()</xhtml:li> <xhtml:li>CWE-272 POS02-C Follow the principle of least privilege</xhtml:li> <xhtml:li>CWE-273 POS37-C Ensure that privilege relinquishment is successful</xhtml:li> <xhtml:li>CWE-363 POS35-C Avoid race conditions while checking for the existence of a symbolic link</xhtml:li> <xhtml:li>CWE-366 POS00-C Avoid race conditions with multiple threads</xhtml:li> <xhtml:li>CWE-562 POS34-C Do not call putenv() with a pointer to an automatic variable as the argument</xhtml:li> <xhtml:li>CWE-667 POS31-C Do not unlock or destroy another thread's mutex</xhtml:li> <xhtml:li>CWE-686 POS34-C Do not call putenv() with a pointer to an automatic variable as the argument</xhtml:li> <xhtml:li>CWE-696 POS36-C Observe correct revocation order while relinquishing privileges</xhtml:li> </xhtml:ul>

Źródła