CWE-242: Use of Inherently Dangerous Function

Description

The product calls a function that can never be guaranteed to work safely.

Certain functions behave in dangerous ways regardless of how they are used. Functions in this category were often implemented without taking security concerns into account. The gets() function is unsafe because it does not perform bounds checking on the size of its input. An attacker can easily send arbitrarily-sized input to gets() and overflow the destination buffer. Similarly, the >> operator is unsafe to use when reading into a statically-allocated character array because it does not perform bounds checking on the size of its input. An attacker can easily send arbitrarily-sized input to the >> operator and overflow the destination buffer.

Potential Impact

Other

Varies by Context

Demonstrative Examples

The code below calls gets() to read information into a buffer.

Bad

char buf[BUFSIZE];gets(buf);

The gets() function in C is inherently unsafe.

The code below calls the gets() function to read in data from the command line.

Bad

char buf[24];printf("Please enter your name and press <Enter>\n");gets(buf);...}

However, gets() is inherently unsafe, because it copies all input from STDIN to the buffer without checking size. This allows the user to provide a string that is larger than the buffer size, resulting in an overflow condition.

Mitigations & Prevention

Build and CompilationImplementation

Identify a list of prohibited API functions and prohibit developers from using these functions, providing safer alternatives. In some cases, automatic code analysis tools or the compiler can be instructed to spot use of prohibited functions, such as the "banned.h" include file from Microsoft's SDL. [REF-554] [REF-1009] [REF-7]

Testing

Use grep or static analysis tools to spot usage of dangerous functions.

Detection Methods

Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea

Real-World CVE Examples

CVE ID	Description
CVE-2007-4004	FTP client uses inherently insecure gets() function and is setuid root on some systems, allowing buffer overflow

Taxonomy Mappings

7 Pernicious Kingdoms: — Dangerous Functions
CERT C Secure Coding: POS33-C — Do not use vfork()
Software Fault Patterns: SFP3 — Use of an improper API

Frequently Asked Questions

What is CWE-242?

CWE-242 (Use of Inherently Dangerous Function) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The product calls a function that can never be guaranteed to work safely.

How can CWE-242 be exploited?

Attackers can exploit CWE-242 (Use of Inherently Dangerous Function) to varies by context. This weakness is typically introduced during the Implementation phase of software development.

How do I prevent CWE-242?

Key mitigations include: Identify a list of prohibited API functions and prohibit developers from using these functions, providing safer alternatives. In some cases, automatic code analysis tools or the compiler can be instru

What is the severity of CWE-242?

CWE-242 is classified as a Base-level weakness (Medium abstraction). It has been observed in 1 real-world CVEs.