2314
Nature Type ID Name Page
HasMember 251 Often Misused: String Management 700 2314
HasMember 252 Unchecked Return Value 700 606
HasMember 558 Use of getlogin() in Multithreaded Application 700 1272
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CERT C Secure Coding WIN30-C CWE More
Abstract
Properly pair allocation and
deallocation functions
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
Category-251: Often Misused: String Management
Category ID : 251
Summary
Functions that manipulate strings encourage buffer overflows.
Membership
Nature Type ID Name Page
MemberOf 227 7PK - API Abuse 700 2313
MemberOf 974 SFP Secondary Cluster: Incorrect Buffer Length
Computation
888 2406
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Often Misused: Strings
Software Fault Patterns SFP10 Incorrect Buffer Length Computation
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
Category-254: 7PK - Security Features
Category ID : 254
Summary
Software security is not security software. Here we're concerned with topics like authentication,
access control, confidentiality, cryptography, and privilege management.
Membership
CWE Version 4.14
CWE-255: Credentials Management Errors
CWE-255: Credentials Management Errors