1504
Related Attack Patterns
CAPEC-ID Attack Pattern Name
128 Integer Attacks
129 Pointer Manipulation
References
[REF-106]David LeBlanc and Niels Dekker. "SafeInt". < http://safeint.codeplex.com/ >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-683: Function Call With Incorrect Order of Arguments
Weakness ID : 683
Structure : Simple
Abstraction : Variant
Description
The product calls a function, procedure, or routine, but the caller specifies the arguments in an
incorrect order, leading to resultant weaknesses.
Extended Description
While this weakness might be caught by the compiler in some languages, it can occur more
frequently in cases in which the called function accepts variable numbers or types of arguments,
such as format strings in C. It also can occur in languages or environments that do not enforce
strong typing.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 628 Function Call with Incorrectly Specified Arguments 1398
Weakness Ordinalities
Primary :
Common Consequences
Scope Impact Likelihood
Other Quality Degradation
Potential Mitigations
Phase: Implementation
Use the function, procedure, or routine as specified.
Phase: Testing
Because this function call often produces incorrect behavior it will usually be detected during
testing or normal operation of the product. During testing exercise all possible control paths will
typically expose this weakness except in rare cases when the incorrect function call accidentally
CWE Version 4.14
CWE-684: Incorrect Provision of Specified Functionality
CWE-684: Incorrect Provision of Specified Functionality