1564
CAPEC-ID Attack Pattern Name
9 Buffer Overflow in Local Command-Line Utilities
10 Buffer Overflow via Environment Variables
24 Filter Failure through Buffer Overflow
46 Overflow Variables and Tags
References
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
CWE-749: Exposed Dangerous Method or Function
Weakness ID : 749
Structure : Simple
Abstraction : Base
Description
The product provides an Applications Programming Interface (API) or similar interface for
interaction with external actors, but the interface includes a dangerous method or function that is
not properly restricted.
Extended Description
This weakness can lead to a wide variety of resultant weaknesses, depending on the behavior of
the exposed method. It can apply to any number of technologies and approaches, such as ActiveX
controls, Java functions, IOCTLs, and so on.
The exposure can occur in a few different ways:
• The function/method was never intended to be exposed to outside actors.
• The function/method was only intended to be accessible to a limited set of actors, such as
Internet-based access from a single web site.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 284 Improper Access Control 680
ParentOf 618 Exposed Unsafe ActiveX Method 1380
ParentOf 782 Exposed IOCTL with Insufficient Access Control 1648
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1228 API / Function Errors 2482
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
CWE Version 4.14
CWE-749: Exposed Dangerous Method or Function
CWE-749: Exposed Dangerous Method or Function