CWE-676: Use of Potentially Dangerous Function
The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.
View on MITRETechnical Details
- Structure
- Simple
Applicable To
Security Consequences
Scope
Impact
If the function is used incorrectly, then it could result in security problems.
Mitigation Strategies
Phase
Description
Identify a list of prohibited API functions and prohibit developers from using these functions, providing safer alternatives. In some cases, automatic code analysis tools or the compiler can be instructed to spot use of prohibited functions, such as the "banned.h" include file from Microsoft's SDL. [REF-554] [REF-7]
Detection Methods
Method
Automated Static Analysis - Binary or BytecodeDescription
According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Bytecode Weakness Analysis - including disassembler + source code weakness analysis Binary Weakness Analysis - including disassembler + source code weakness analysis Cost effective for partial coverage: Binary / Bytecode Quality Analysis Binary / Bytecode simple extractor - strings, ELF readers, etc.
Effectiveness
HighMethod
Dynamic Analysis with Manual Results InterpretationDescription
According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Debugger Cost effective for partial coverage: Monitored Virtual Environment - run potentially malicious code in sandbox / wrapper / virtual machine, see if it does anything suspicious
Effectiveness
HighMethod
Manual Static Analysis - Source CodeDescription
According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Manual Source Code Review (not inspections) Cost effective for partial coverage: Focused Manual Spotcheck - Focused manual analysis of source
Effectiveness
HighMethod
Automated Static Analysis - Source CodeDescription
According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer Cost effective for partial coverage: Warning Flags Source Code Quality Analyzer
Effectiveness
HighMethod
Architecture or Design ReviewDescription
According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: Formal Methods / Correct-By-Construction Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)
Effectiveness
HighCode Examples & CVEs
Demonstrative Examples
The following code attempts to create a local copy of a buffer to perform some manipulations to the data.
However, the programmer does not ensure that the size of the data pointed to by string will fit in the local buffer and copies the data with the potentially dangerous strcpy() function. This may result in a buffer overflow condition if an attacker can influence the contents of the string parameter.
Observed CVE Examples (6)
CWE Relationships
No relationship information available for this CWE.
Frequently Asked Questions
What is CWE-676: Use of Potentially Dangerous Function?+
CWE-676: Use of Potentially Dangerous Function is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.
What are the security consequences of Use of Potentially Dangerous Function?+
If exploited, CWE-676 (Use of Potentially Dangerous Function) it can compromise Other, leading to outcomes such as Varies by Context, Quality Degradation and Unexpected State.
How do you prevent or mitigate Use of Potentially Dangerous Function?+
Recommended mitigations for CWE-676 include: Identify a list of prohibited API functions and prohibit developers from using these functions, providing safer alternatives. In some cases, automatic code analysis tools or the compiler can be instructed to spot use of prohibited functions, such as the "banned.h" include file from Microsoft's SDL. [REF-554] [REF-7]
How is Use of Potentially Dangerous Function detected?+
CWE-676 can be detected using Automated Static Analysis - Binary or Bytecode, Dynamic Analysis with Manual Results Interpretation, Manual Static Analysis - Source Code, Automated Static Analysis - Source Code and Architecture or Design Review. Combining automated tooling with manual review typically yields the best coverage.
Which programming languages are affected by Use of Potentially Dangerous Function?+
CWE-676 commonly affects C and C++. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
What are real-world examples of Use of Potentially Dangerous Function?+
MITRE documents real CVEs mapped to CWE-676, including CVE-2007-1470, CVE-2009-3849, CVE-2006-2114, CVE-2006-0963 and CVE-2011-0712. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
What is the difference between a CWE and a CVE?+
A CWE (Common Weakness Enumeration) like CWE-676 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.