CWE-676
Use of Potentially Dangerous Function
AI Translation Available
The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.
Status
draft
Abstraction
base
Likelihood
high
Affected Platforms
C
C++
Technical Details
AI Translation
Common Consequences
other
Impacts
varies by context
quality degradation
unexpected state
Detection Methods
automated static analysis - binary or bytecode
manual static analysis - binary or bytecode
dynamic analysis with manual results interpretation
manual static analysis - source code
automated static analysis - source code
automated static analysis
architecture or design review
Potential Mitigations
Phases:
build and compilation
implementation
Descriptions:
•
Identify a list of prohibited API functions and prohibit developers from using these functions, providing safer alternatives. In some cases, automatic code analysis tools or the compiler can be instructed to spot use of prohibited functions, such as the "banned.h" include file from Microsoft's SDL. [REF-554] [REF-7]