1492
Reference Description
CVE-2008-5005 Buffer overflow using strcpy()
https://www.cve.org/CVERecord?id=CVE-2008-5005
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 738 CERT C Secure Coding Standard (2008) Chapter 5 -
Integers (INT)
734 2342
MemberOf 743 CERT C Secure Coding Standard (2008) Chapter 10 -
Input Output (FIO)
734 2347
MemberOf 746 CERT C Secure Coding Standard (2008) Chapter 13 -
Error Handling (ERR)
734 2350
MemberOf 865 2011 Top 25 - Risky Resource Management 900 2371
MemberOf 872 CERT C++ Secure Coding Section 04 - Integers (INT) 868 2374
MemberOf 877 CERT C++ Secure Coding Section 09 - Input Output
(FIO)
868 2377
MemberOf 884 CWE Cross-section 884 2567
MemberOf 1001 SFP Secondary Cluster: Use of an Improper API 888 2420
MemberOf 1161 SEI CERT C Coding Standard - Guidelines 07.
Characters and Strings (STR)
1154 2458
MemberOf 1165 SEI CERT C Coding Standard - Guidelines 10.
Environment (ENV)
1154 2460
MemberOf 1167 SEI CERT C Coding Standard - Guidelines 12. Error
Handling (ERR)
1154 2461
MemberOf 1169 SEI CERT C Coding Standard - Guidelines 14.
Concurrency (CON)
1154 2462
MemberOf 1170 SEI CERT C Coding Standard - Guidelines 48.
Miscellaneous (MSC)
1154 2463
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Notes
Relationship
This weakness is different than CWE-242 (Use of Inherently Dangerous Function). CWE-242
covers functions with such significant security problems that they can never be guaranteed to
be safe. Some functions, if used properly, do not directly pose a security risk, but can introduce
a weakness if not called correctly. These are regarded as potentially dangerous. A well-known
example is the strcpy() function. When provided with a destination buffer that is larger than its
source, strcpy() will not overflow. However, it is so often misused that some developers prohibit
strcpy() entirely.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Dangerous Functions
CERT C Secure Coding CON33-
C
CWE More
Abstract
Avoid race conditions when using
library functions
CERT C Secure Coding ENV33-C CWE More
Abstract
Do not call system()
CERT C Secure Coding ERR07-
C
Prefer functions that support error
checking over equivalent functions that
don't
CWE Version 4.14
CWE-680: Integer Overflow to Buffer Overflow
CWE-680: Integer Overflow to Buffer Overflow