1491
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer Cost
effective for partial coverage: Warning Flags Source Code Quality Analyzer
Effectiveness = High
Automated Static Analysis
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Origin Analysis
Effectiveness = SOAR Partial
Architecture or Design Review
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Formal Methods / Correct-By-Construction Inspection (IEEE 1028 standard) (can apply to
requirements, design, source code, etc.)
Effectiveness = High
Potential Mitigations
Phase: Build and Compilation
Phase: Implementation
Identify a list of prohibited API functions and prohibit developers from using these functions,
providing safer alternatives. In some cases, automatic code analysis tools or the compiler can be
instructed to spot use of prohibited functions, such as the "banned.h" include file from Microsoft's
SDL. [REF-554] [REF-7]
Demonstrative Examples
Example 1:
The following code attempts to create a local copy of a buffer to perform some manipulations to the
data.
Example Language: C (Bad)
void manipulate_string(char * string){
char buf[24];
strcpy(buf, string);
...
}
However, the programmer does not ensure that the size of the data pointed to by string will fit in the
local buffer and copies the data with the potentially dangerous strcpy() function. This may result in
a buffer overflow condition if an attacker can influence the contents of the string parameter.
Observed Examples
Reference Description
CVE-2007-1470 Library has multiple buffer overflows using sprintf() and strcpy()
https://www.cve.org/CVERecord?id=CVE-2007-1470
CVE-2009-3849 Buffer overflow using strcat()
https://www.cve.org/CVERecord?id=CVE-2009-3849
CVE-2006-2114 Buffer overflow using strcpy()
https://www.cve.org/CVERecord?id=CVE-2006-2114
CVE-2006-0963 Buffer overflow using strcpy()
https://www.cve.org/CVERecord?id=CVE-2006-0963
CVE-2011-0712 Vulnerable use of strcpy() changed to use safer strlcpy()
https://www.cve.org/CVERecord?id=CVE-2011-0712
CWE Version 4.14
CWE-676: Use of Potentially Dangerous Function
CWE-676: Use of Potentially Dangerous Function