CWE-676: Use of Potentially Dangerous Function

Description

The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.

Abstraction: BaseA weakness specific enough to point to detection and prevention methods.
Likelihood of exploit: High
Status: Draft

Common consequences

Other
Varies by Context; Quality Degradation; Unexpected State
If the function is used incorrectly, then it could result in security problems.

Potential mitigations

Build and CompilationImplementation
Identify a list of prohibited API functions and prohibit developers from using these functions, providing safer alternatives. In some cases, automatic code analysis tools or the compiler can be instructed to spot use of prohibited functions, such as the banned.h include file from Microsoft's SDL.

Related weaknesses

Parent weaknesses

CWE-1177Use of Prohibited Code

Child weaknesses

CWE-785Use of Path Manipulation Function without Maximum-sized Buffer

CAPEC attack patterns that exploit it

CWE 4.20 links no CAPEC attack pattern to this weakness.

Potential mitigations

Build and CompilationImplementation

Identify a list of prohibited API functions and prohibit developers from using these functions, providing safer alternatives. In some cases, automatic code analysis tools or the compiler can be instructed to spot use of prohibited functions, such as the banned.h include file from Microsoft's SDL.