1525
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 573 Improper Following of Specification by Caller 1298
ParentOf 111 Direct Use of Unsafe JNI 266
ParentOf 245 J2EE Bad Practices: Direct Management of Connections 592
ParentOf 246 J2EE Bad Practices: Direct Use of Sockets 594
ParentOf 383 J2EE Bad Practices: Direct Use of Threads 935
ParentOf 574 EJB Bad Practices: Use of Synchronization Primitives 1300
ParentOf 575 EJB Bad Practices: Use of AWT Swing 1301
ParentOf 576 EJB Bad Practices: Use of Java I/O 1304
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1228 API / Function Errors 2482
Common Consequences
Scope Impact Likelihood
Other Other
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Demonstrative Examples
Example 1:
The following code defines a class named Echo. The class declares one native method (defined
below), which uses C to echo commands entered on the console back to the user. The following C
code defines the native method implemented in the Echo class:
Example Language: Java (Bad)
class Echo {
public native void runEcho();
static {
System.loadLibrary("echo");
}
public static void main(String[] args) {
new Echo().runEcho();
}
}
Example Language: C (Bad)
#include <jni.h>
#include "Echo.h"//the java class above compiled with javah
#include <stdio.h>
JNIEXPORT void JNICALL
Java_Echo_runEcho(JNIEnv *env, jobject obj)
{
char buf[64];
gets(buf);
CWE Version 4.14
CWE-695: Use of Low-Level Functionality
CWE-695: Use of Low-Level Functionality