586
Reference Description
CVE-1999-1156 FTP server crash via PORT command with non-numeric character.
https://www.cve.org/CVERecord?id=CVE-1999-1156
CVE-2004-0270 Anti-virus product has assert error when line length is non-numeric.
https://www.cve.org/CVERecord?id=CVE-2004-0270
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 743 CERT C Secure Coding Standard (2008) Chapter 10 -
Input Output (FIO)
734 2347
MemberOf 877 CERT C++ Secure Coding Section 09 - Input Output
(FIO)
868 2377
MemberOf 993 SFP Secondary Cluster: Incorrect Input Handling 888 2417
MemberOf 1163 SEI CERT C Coding Standard - Guidelines 09. Input
Output (FIO)
1154 2459
MemberOf 1407 Comprehensive Categorization: Improper Neutralization 1400 2532
Notes
Research Gap
Probably under-studied.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Wrong Data Type
CERT C Secure Coding FIO37-C CWE More
Abstract
Do not assume that fgets() or fgetws()
returns a nonempty string when
successful
Related Attack Patterns
CAPEC-ID Attack Pattern Name
48 Passing Local Filenames to Functions That Expect a URL
CWE-242: Use of Inherently Dangerous Function
Weakness ID : 242
Structure : Simple
Abstraction : Base
Description
The product calls a function that can never be guaranteed to work safely.
Extended Description
Certain functions behave in dangerous ways regardless of how they are used. Functions in this
category were often implemented without taking security concerns into account. The gets() function
is unsafe because it does not perform bounds checking on the size of its input. An attacker can
easily send arbitrarily-sized input to gets() and overflow the destination buffer. Similarly, the >>
operator is unsafe to use when reading into a statically-allocated character array because it does
not perform bounds checking on the size of its input. An attacker can easily send arbitrarily-sized
input to the >> operator and overflow the destination buffer.
Relationships
CWE Version 4.14
CWE-242: Use of Inherently Dangerous Function
CWE-242: Use of Inherently Dangerous Function