1399
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other
Access Control
Quality Degradation
Gain Privileges or Assume Identity
This weakness can cause unintended behavior and can
lead to additional weaknesses such as allowing an attacker
to gain unintended access to system resources.
Detection Methods
Other
Since these bugs typically introduce incorrect behavior that is obvious to users, they are
found quickly, unless they occur in rarely-tested code paths. Managing the correct number of
arguments can be made more difficult in cases where format strings are used, or when variable
numbers of arguments are supported.
Potential Mitigations
Phase: Build and Compilation
Once found, these issues are easy to fix. Use code inspection tools and relevant compiler
features to identify potential violations. Pay special attention to code that is not likely to be
exercised heavily during QA.
Phase: Architecture and Design
Make sure your API's are stable before you use them in production code.
Demonstrative Examples
Example 1:
The following PHP method authenticates a user given a username/password combination but is
called with the parameters in reverse order.
Example Language: PHP (Bad)
function authenticate($username, $password) {
// authenticate user
...
}
authenticate($_POST['password'], $_POST['username']);
Example 2:
This Perl code intends to record whether a user authenticated successfully or not, and to exit if the
user fails to authenticate. However, when it calls ReportAuth(), the third argument is specified as 0
instead of 1, so it does not exit.
Example Language: Perl (Bad)
sub ReportAuth {
my ($username, $result, $fatal) = @_;
PrintLog("auth: username=%s, result=%d", $username, $result);
if (($result ne "success") && $fatal) {
die "Failed!\n";
}
}
sub PrivilegedFunc
{
my $result = CheckAuth($username);
CWE Version 4.14
CWE-628: Function Call with Incorrectly Specified Arguments
CWE-628: Function Call with Incorrectly Specified Arguments