Use of Inherently Dangerous Function

Draft Base
Structure: Simple
Description

This vulnerability occurs when code uses functions that are inherently unsafe and cannot be reliably secured, posing a direct risk to application stability and security.

Extended Description

Some functions are dangerous by design because they were created without security in mind, such as failing to check boundaries on user input. A classic example is the `gets()` function, which reads input without any limit on its size, allowing an attacker to overflow the destination buffer and potentially execute arbitrary code. Similarly, using the `>>` operator to read into a fixed-size character array is risky for the same reason—it doesn't validate input length, leading to buffer overflows. To prevent these issues, developers should replace these inherently dangerous functions with secure alternatives. For instance, use `fgets()` instead of `gets()` and employ methods with explicit bounds checking, like `std::string` in C++ or `scanf()` with width specifiers. Always validate and limit all external input to ensure it fits within the allocated buffer size, eliminating the root cause of these exploitable overflows.

Common Consequences 1
Scope: Other

Impact: Varies by Context

Detection Methods 1
Automated Static AnalysisHigh
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Potential Mitigations 2
Phase: ImplementationRequirements
Ban the use of dangerous functions. Use their safe equivalent.
Phase: Testing
Use grep or static analysis tools to spot usage of dangerous functions.
Demonstrative Examples 2
The code below calls gets() to read information into a buffer.

Code Example:

Bad
C
c
The gets() function in C is inherently unsafe.

ID : DX-5

The code below calls the gets() function to read in data from the command line.

Code Example:

Bad
C
c
However, gets() is inherently unsafe, because it copies all input from STDIN to the buffer without checking size. This allows the user to provide a string that is larger than the buffer size, resulting in an overflow condition.
Observed Examples 1
CVE-2007-4004FTP client uses inherently insecure gets() function and is setuid root on some systems, allowing buffer overflow
References 3
Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors
Katrina Tsipenyuk, Brian Chess, and Gary McGraw
NIST Workshop on Software Security Assurance Tools Techniques and MetricsNIST
07-11-2005
ID: REF-6
Herb Schildt's C++ Programming Cookbook
Herbert Schildt
McGraw-Hill Osborne Media
28-04-2008
ID: REF-194
Writing Secure Code
Michael Howard and David LeBlanc
Microsoft Press
04-12-2002
ID: REF-7
Likelihood of Exploit

High

Applicable Platforms
Languages:
C : UndeterminedC++ : Undetermined
Modes of Introduction
Implementation
Related Weaknesses
Taxonomy Mapping
  • 7 Pernicious Kingdoms
  • CERT C Secure Coding
  • Software Fault Patterns