304
ChildOf 676 Use of Potentially Dangerous Function 1489
Relevant to the view "Seven Pernicious Kingdoms" (CWE-700)
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
Applicable Platforms
Language : C (Prevalence = Undetermined)
Language : C++ (Prevalence = Undetermined)
Background Details
Windows provides a large number of utility functions that manipulate buffers containing filenames.
In most cases, the result is returned in a buffer that is passed in as input. (Usually the filename is
modified in place.) Most functions require the buffer to be at least MAX_PATH bytes in length, but
you should check the documentation for each function individually. If the buffer is not large enough
to store the result of the manipulation, a buffer overflow can occur.
Common Consequences
Scope Impact Likelihood
Integrity
Confidentiality
Availability
Modify Memory
Execute Unauthorized Code or Commands
DoS: Crash, Exit, or Restart
Potential Mitigations
Phase: Implementation
CWE Version 4.14
CWE-785: Use of Path Manipulation Function without Maximum-sized Buffer
CWE-785: Use of Path Manipulation Function without Maximum-sized Buffer