CWE-676

Use of Potentially Dangerous Function

Base

Draft

Description

The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.

Parent Weaknesses (ChildOf)

CWE-1177: Use of Prohibited Code...

Common Consequences

Scope

Other

Impact

Varies by Context, Quality Degradation, Unexpected State

Potential Mitigations

Build and Compilation

Implementation

Identify a list of prohibited API functions and prohibit developers from using these functions, providing safer alternatives. In some cases, automatic code analysis tools or the compiler can be instructed to spot use of prohibited functions, such as the "banned.h" include file from Microsoft's SDL. [REF-554] [REF-1009] [REF-7]

CVE-2007-1470

Library has multiple buffer overflows using sprintf() and strcpy()

CVE-2009-3849

Buffer overflow using strcat()

CVE-2006-2114

Buffer overflow using strcpy()

CVE-2006-0963

Buffer overflow using strcpy()

CVE-2011-0712

Vulnerable use of strcpy() changed to use safer strlcpy()

CVE-2008-5005

Buffer overflow using strcpy()