ByteOS Network

CWE-1177:Use of Prohibited Code

Weakness ID:1177

Version:v4.17

Weakness Name:Use of Prohibited Code

Vulnerability Mapping:Allowed-with-Review

Abstraction:Class

Structure:Simple

Status:Incomplete

Details Content History Observed CVE Examples Reports

▼Description

The product uses a function, library, or third party component that has been explicitly prohibited, whether by the developer or the customer.

▼Extended Description

The developer - or customers - may wish to restrict or eliminate use of a function, library, or third party component for any number of reasons, including real or suspected vulnerabilities; difficulty to use securely; export controls or license requirements; obsolete or poorly-maintained code; internal code being scheduled for deprecation; etc.

To reduce risk of vulnerabilities, the developer might maintain a list of "banned" functions that programmers must avoid using because the functions are difficult or impossible to use securely. This issue can also make the product more costly and difficult to maintain.

▼Relationships

Relevant to the view"Research Concepts - (1000)"

Nature	Mapping	Type	ID	Name
ChildOf	Discouraged	P	710	Improper Adherence to Coding Standards
ParentOf	Allowed	B	242	Use of Inherently Dangerous Function
ParentOf	Allowed	B	676	Use of Potentially Dangerous Function

Nature: ChildOf

Mapping: Discouraged

Type: Pillar

ID: 710

Name: Improper Adherence to Coding Standards

Nature: ParentOf

Mapping: Allowed

Type: Base

ID: 242

Name: Use of Inherently Dangerous Function

Nature: ParentOf

Mapping: Allowed

Type: Base

ID: 676

Name: Use of Potentially Dangerous Function

▼Memberships

Nature	Mapping	Type	ID	Name
MemberOf	Prohibited	C	1412	Comprehensive Categorization: Poor Coding Practices

Nature: MemberOf

Mapping: Prohibited

Type:Category

ID: 1412

Name: Comprehensive Categorization: Poor Coding Practices

▼Tags

Nature	Mapping	Type	ID	Name
MemberOf	Prohibited	BS	BOSS-310	Reduce Maintainability (impact)

Nature: MemberOf

Mapping: Prohibited

Type:BOSSView

ID: BOSS-310

Name: Reduce Maintainability (impact)

▼Common Consequences

Scope	Likelihood	Impact	Note
Other	N/A	Reduce Maintainability	N/A

Scope: Other

Likelihood: N/A

Impact: Reduce Maintainability

Note:

N/A

▼Modes Of Introduction

Phase: Implementation

Note:

N/A

▼Demonstrative Examples

Example 1

The code below calls the gets() function to read in data from the command line.

Language: C(Bad code)

char buf[24]; printf("Please enter your name and press <Enter>\n"); gets(buf); ... }

However, gets() is inherently unsafe, because it copies all input from STDIN to the buffer without checking size. This allows the user to provide a string that is larger than the buffer size, resulting in an overflow condition.

Example 2

The following code attempts to create a local copy of a buffer to perform some manipulations to the data.

Language: C(Bad code)

void manipulate_string(char * string){ char buf[24]; strcpy(buf, string); ... }

However, the programmer does not ensure that the size of the data pointed to by string will fit in the local buffer and copies the data with the potentially dangerous strcpy() function. This may result in a buffer overflow condition if an attacker can influence the contents of the string parameter.

▼Observed Examples

Reference	Description
CVE-2007-1470	Library has multiple buffer overflows using sprintf() and strcpy()
CVE-2007-4004	FTP client uses inherently insecure gets() function and is setuid root on some systems, allowing buffer overflow

Reference: CVE-2007-1470

Description:

Library has multiple buffer overflows using sprintf() and strcpy()

Reference: CVE-2007-4004

Description:

FTP client uses inherently insecure gets() function and is setuid root on some systems, allowing buffer overflow

▼Weakness Ordinalities

Ordinality	Description
Indirect	N/A
Primary	N/A

Ordinality: Indirect

Description:

N/A

Ordinality: Primary

Description:

N/A

▼Vulnerability Mapping Notes

Usage:Allowed-with-Review

Reason:Abstraction

Rationale:

This CWE entry is a Class and might have Base-level children that would be more appropriate

Comments:

Examine children of this entry to see if there is a better fit

▼References

Reference ID: REF-1009

Title: Microsoft's Free Security Tools - banned.h

Author: Tim Rains

Publication:

URL:https://www.microsoft.com/en-us/security/blog/2012/08/30/microsofts-free-security-tools-banned-h/

URL Date:2023-04-07

Day:30

Month:08

Year:2012

Reference ID: REF-1010

Title: Microsoft's Free Security Tools - banned.h

Author: Michael Howard

Publication:

URL:https://www.microsoft.com/en-us/security/blog/2012/08/30/microsofts-free-security-tools-banned-h/

URL Date:2023-04-07

Day:N/A

Month:06

Year:2011