588
The gets() function in C is inherently unsafe.
Example 2:
The code below calls the gets() function to read in data from the command line.
Example Language: C (Bad)
char buf[24];
printf("Please enter your name and press <Enter>\n");
gets(buf);
...
}
However, gets() is inherently unsafe, because it copies all input from STDIN to the buffer without
checking size. This allows the user to provide a string that is larger than the buffer size, resulting in
an overflow condition.
Observed Examples
Reference Description
CVE-2007-4004 FTP client uses inherently insecure gets() function and is setuid root on some
systems, allowing buffer overflow
https://www.cve.org/CVERecord?id=CVE-2007-4004
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 227 7PK - API Abuse 700 2313
MemberOf 748 CERT C Secure Coding Standard (2008) Appendix -
POSIX (POS)
734 2351
MemberOf 1001 SFP Secondary Cluster: Use of an Improper API 888 2420
MemberOf 1171 SEI CERT C Coding Standard - Guidelines 50. POSIX
(POS)
1154 2463
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Dangerous Functions
CERT C Secure Coding POS33-
C
CWE More
Abstract
Do not use vfork()
Software Fault Patterns SFP3 Use of an improper API
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
[REF-194]Herbert Schildt. "Herb Schildt's C++ Programming Cookbook". 2008 April 8. McGraw-Hill
Osborne Media.
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
CWE Version 4.14
CWE-243: Creation of chroot Jail Without Changing Working Directory
CWE-243: Creation of chroot Jail Without Changing Working Directory