1973
Nature Type ID Name Page
ParentOf 242 Use of Inherently Dangerous Function 586
ParentOf 676 Use of Potentially Dangerous Function 1489
Weakness Ordinalities
Indirect :
Primary :
Common Consequences
Scope Impact Likelihood
Other Reduce Maintainability
Demonstrative Examples
Example 1:
The code below calls the gets() function to read in data from the command line.
Example Language: C (Bad)
char buf[24];
printf("Please enter your name and press <Enter>\n");
gets(buf);
...
}
However, gets() is inherently unsafe, because it copies all input from STDIN to the buffer without
checking size. This allows the user to provide a string that is larger than the buffer size, resulting in
an overflow condition.
Example 2:
The following code attempts to create a local copy of a buffer to perform some manipulations to the
data.
Example Language: C (Bad)
void manipulate_string(char * string){
char buf[24];
strcpy(buf, string);
...
}
However, the programmer does not ensure that the size of the data pointed to by string will fit in the
local buffer and copies the data with the potentially dangerous strcpy() function. This may result in
a buffer overflow condition if an attacker can influence the contents of the string parameter.
Observed Examples
Reference Description
CVE-2007-1470 Library has multiple buffer overflows using sprintf() and strcpy()
https://www.cve.org/CVERecord?id=CVE-2007-1470
CVE-2007-4004 FTP client uses inherently insecure gets() function and is setuid root on some
systems, allowing buffer overflow
https://www.cve.org/CVERecord?id=CVE-2007-4004
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-1188: Initialization of a Resource with an Insecure Default
CWE-1188: Initialization of a Resource with an Insecure Default