2347
References
[REF-597]Robert C. Seacord. "The CERT C Secure Coding Standard". 1st Edition. 2008 October
4. Addison-Wesley Professional.
Category-743: CERT C Secure Coding Standard (2008) Chapter 10 - Input
Output (FIO)
Category ID : 743
Summary
Weaknesses in this category are related to the rules and recommendations in the Input Output
(FIO) chapter of the CERT C Secure Coding Standard (2008).
Membership
Nature Type ID Name Page
MemberOf 734 Weaknesses Addressed by the CERT C Secure Coding
Standard (2008)
734 2560
HasMember 22 Improper Limitation of a Pathname to a Restricted
Directory ('Path Traversal')
734 33
HasMember 37 Path Traversal: '/absolute/pathname/here' 734 79
HasMember 38 Path Traversal: '\absolute\pathname\here' 734 80
HasMember 39 Path Traversal: 'C:dirname' 734 82
HasMember 41 Improper Resolution of Path Equivalence 734 86
HasMember 59 Improper Link Resolution Before File Access ('Link
Following')
734 111
HasMember 62 UNIX Hard Link 734 119
HasMember 64 Windows Shortcut Following (.LNK) 734 121
HasMember 65 Windows Hard Link 734 123
HasMember 67 Improper Handling of Windows Device Names 734 126
HasMember 119 Improper Restriction of Operations within the Bounds of
a Memory Buffer
734 293
HasMember 134 Use of Externally-Controlled Format String 734 365
HasMember 241 Improper Handling of Unexpected Data Type 734 584
HasMember 276 Incorrect Default Permissions 734 665
HasMember 279 Incorrect Execution-Assigned Permissions 734 671
HasMember 362 Concurrent Execution using Shared Resource with
Improper Synchronization ('Race Condition')
734 888
HasMember 367 Time-of-check Time-of-use (TOCTOU) Race Condition 734 906
HasMember 379 Creation of Temporary File in Directory with Insecure
Permissions
734 930
HasMember 391 Unchecked Error Condition 734 948
HasMember 403 Exposure of File Descriptor to Unintended Control
Sphere ('File Descriptor Leak')
734 978
HasMember 404 Improper Resource Shutdown or Release 734 980
HasMember 552 Files or Directories Accessible to External Parties 734 1265
HasMember 675 Multiple Operations on Resource in Single-Operation
Context
734 1487
HasMember 676 Use of Potentially Dangerous Function 734 1489
HasMember 686 Function Call With Incorrect Argument Type 734 1508
HasMember 732 Incorrect Permission Assignment for Critical Resource 734 1551
CWE Version 4.14
CWE-744: CERT C Secure Coding Standard (2008) Chapter 11 - Environment (ENV)
CWE-744: CERT C Secure Coding Standard
(2008) Chapter 11 - Environment (ENV) 2348
Notes
Relationship
In the 2008 version of the CERT C Secure Coding standard, the following rules were mapped to
the following CWE IDs: CWE-22 FIO02-C Canonicalize path names originating from untrusted
sources CWE-37 FIO05-C Identify files using multiple file attributes CWE-38 FIO05-C Identify
files using multiple file attributes CWE-39 FIO05-C Identify files using multiple file attributes
CWE-41 FIO02-C Canonicalize path names originating from untrusted sources CWE-59 FIO02-
C Canonicalize path names originating from untrusted sources CWE-62 FIO05-C Identify files
using multiple file attributes CWE-64 FIO05-C Identify files using multiple file attributes CWE-65
FIO05-C Identify files using multiple file attributes CWE-67 FIO32-C Do not perform operations
on devices that are only appropriate for files CWE-119 FIO37-C Do not assume character data
has been read CWE-134 FIO30-C Exclude user input from format strings CWE-134 FIO30-C
Exclude user input from format strings CWE-241 FIO37-C Do not assume character data has
been read CWE-276 FIO06-C Create files with appropriate access permissions CWE-279 FIO06-
C Create files with appropriate access permissions CWE-362 FIO31-C Do not simultaneously
open the same file multiple times CWE-367 FIO01-C Be careful using functions that use file
names for identification CWE-379 FIO15-C Ensure that file operations are performed in a secure
directory CWE-379 FIO43-C Do not create temporary files in shared directories CWE-391 FIO04-
C Detect and handle input and output errors CWE-391 FIO33-C Detect and handle input output
errors resulting in undefined behavior CWE-403 FIO42-C Ensure files are properly closed when
they are no longer needed CWE-404 FIO42-C Ensure files are properly closed when they are
no longer needed CWE-552 FIO15-C Ensure that file operations are performed in a secure
directory CWE-675 FIO31-C Do not simultaneously open the same file multiple times CWE-676
FIO01-C Be careful using functions that use file names for identification CWE-686 FIO00-C
Take care when creating format strings CWE-732 FIO06-C Create files with appropriate access
permissions
References
[REF-597]Robert C. Seacord. "The CERT C Secure Coding Standard". 1st Edition. 2008 October
4. Addison-Wesley Professional.
Category-744: CERT C Secure Coding Standard (2008) Chapter 11 -
Environment (ENV)
Category ID : 744
Summary
Weaknesses in this category are related to the rules and recommendations in the Environment
(ENV) chapter of the CERT C Secure Coding Standard (2008).
Membership
Nature Type ID Name Page
MemberOf 734 Weaknesses Addressed by the CERT C Secure Coding
Standard (2008)
734 2560
HasMember 78 Improper Neutralization of Special Elements used in an
OS Command ('OS Command Injection')
734 151
HasMember 88 Improper Neutralization of Argument Delimiters in a
Command ('Argument Injection')
734 194
HasMember 119 Improper Restriction of Operations within the Bounds of
a Memory Buffer
734 293
HasMember 426 Untrusted Search Path 734 1028
HasMember 462 Duplicate Key in Associative List (Alist) 734 1104
CWE Version 4.14
CWE-745: CERT C Secure Coding Standard (2008) Chapter 12 - Signals (SIG)
CWE-745: CERT C Secure Coding Standard (2008) Chapter 12 - Signals (SIG)