1140
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Source Code Quality Analyzer Source code Weakness Analyzer Context-configured Source
Code Weakness Analyzer
Effectiveness = High
Automated Static Analysis
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Origin Analysis
Effectiveness = High
Architecture or Design Review
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Formal Methods / Correct-By-Construction Inspection (IEEE 1028 standard) (can apply to
requirements, design, source code, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Refer to the documentation for the obsolete function in order to determine why it is deprecated or
obsolete and to learn about alternative ways to achieve the same functionality.
Phase: Requirements
Consider seriously the security implications of using an obsolete function. Consider using
alternate functions.
Demonstrative Examples
Example 1:
The following code uses the deprecated function getpw() to verify that a plaintext password
matches a user's encrypted password. If the password is valid, the function sets result to 1;
otherwise it is set to 0.
Example Language: C (Bad)
...
getpw(uid, pwdline);
for (i=0; i<3; i++){
cryptpw=strtok(pwdline, ":");
pwdline=0;
}
result = strcmp(crypt(plainpw,cryptpw), cryptpw) == 0;
...
Although the code often behaves correctly, using the getpw() function can be problematic from a
security standpoint, because it can overflow the buffer passed to its second parameter. Because of
this vulnerability, getpw() has been supplanted by getpwuid(), which performs the same lookup as
getpw() but returns a pointer to a statically-allocated structure to mitigate the risk. Not all functions
are deprecated or replaced because they pose a security risk. However, the presence of an
obsolete function often indicates that the surrounding code has been neglected and may be in a
state of disrepair. Software security has not been a priority, or even a consideration, for very long.
If the program uses deprecated or obsolete functions, it raises the probability that there are security
problems lurking nearby.
Example 2:
CWE Version 4.14
CWE-477: Use of Obsolete Function
CWE-477: Use of Obsolete Function