1656
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1228 API / Function Errors 2482
Weakness Ordinalities
Primary :
Indirect :
Applicable Platforms
Language : C (Prevalence = Undetermined)
Language : C++ (Prevalence = Undetermined)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Other Varies by Context
Quality Degradation
Unexpected State
If the function is used incorrectly, then it could result in
security problems.
Detection Methods
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Bytecode Weakness Analysis - including disassembler + source code weakness analysis Binary
Weakness Analysis - including disassembler + source code weakness analysis Cost effective for
partial coverage: Binary / Bytecode Quality Analysis Binary / Bytecode simple extractor - strings,
ELF readers, etc.
Effectiveness = High
Manual Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities &
anomalies
Effectiveness = SOAR Partial
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Debugger Cost effective for partial coverage: Monitored Virtual Environment - run potentially
malicious code in sandbox / wrapper / virtual machine, see if it does anything suspicious
Effectiveness = High
Manual Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Manual Source Code Review (not inspections) Cost effective for partial coverage: Focused
Manual Spotcheck - Focused manual analysis of source
Effectiveness = High
CWE Version 4.14
CWE-676: Use of Potentially Dangerous Function
CWE-676: Use of Potentially Dangerous Function