CWE-474 使用具有不一致性实现的函数

Use of Function with Inconsistent Implementations

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: unkown

基本描述

The code uses a function that has inconsistent implementations across operating systems and versions.

扩展描述

The use of inconsistent implementations can cause changes in behavior when the code is ported or built under a different environment than the programmer expects, which can lead to security problems in some cases.

The implementation of many functions varies by platform, and at times, even by different versions of the same platform. Implementation differences can include:

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 758 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 758 cwe_View_ID: 699 cwe_Ordinal: Primary

适用平台

Language: [{'cwe_Name': 'C', 'cwe_Prevalence': 'Often'}, {'cwe_Name': 'PHP', 'cwe_Prevalence': 'Often'}, {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}]

常见的影响

范围	影响	注释
Other	['Quality Degradation', 'Varies by Context']

可能的缓解方案

['Architecture and Design', 'Requirements']

策略:

Do not accept inconsistent behavior from the API specifications when the deviant behavior increase the risk level.

分类映射

映射的分类名	ImNode ID	Fit	Mapped Node Name
7 Pernicious Kingdoms			Inconsistent Implementations
Software Fault Patterns	SFP3		Use of an improper API

文章来源于互联网:scap中文网