简体中文

CWE-734 视图详情

CWE-734

Weaknesses Addressed by the CERT C Secure Coding Standard (2008)
2008-11-24 +00:00
Obsolete
Graph
2023-06-29 +00:00
CWE Mitre.org
指定 CWE 通知
随时了解指定 CWE 的变更。
管理通知

名称: Weaknesses Addressed by the CERT C Secure Coding Standard (2008)

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.

CWE 成员

CWE-743: Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer 基础
CWE-134: Use of Externally-Controlled Format String 基础
CWE-22: Improper Limitation of a Pathname to a Restricted Directory 基础
CWE-241: Improper Handling of Unexpected Data Type 基础
CWE-276: Incorrect Default Permissions 基础
CWE-279: Incorrect Execution-Assigned Permissions 基础
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 基础
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition 基础
CWE-37: Path Traversal: '/absolute/pathname/here' 基础
CWE-379: Creation of Temporary File in Directory with Insecure Permissions 基础
CWE-38: Path Traversal: '\absolute\pathname\here' 基础
CWE-39: Path Traversal: 'C:dirname' 基础
CWE-391: DEPRECATED: Unchecked Error Condition 基础
CWE-403: Exposure of File Descriptor to Unintended Control Sphere 基础
CWE-404: Improper Resource Shutdown or Release 基础
CWE-41: Improper Resolution of Path Equivalence 基础
CWE-552: Files or Directories Accessible to External Parties 基础
CWE-59: Improper Link Resolution Before File Access 基础
CWE-62: UNIX Hard Link 基础
CWE-64: Windows Shortcut Following (.LNK) 基础
CWE-65: Windows Hard Link 基础
CWE-67: Improper Handling of Windows Device Names 基础
CWE-675: Multiple Operations on Resource in Single-Operation Context 基础
CWE-676: Use of Potentially Dangerous Function 基础
CWE-686: Function Call With Incorrect Argument Type 基础
CWE-732: Incorrect Permission Assignment for Critical Resource 基础

CWE 视图信息

漏洞映射说明

依据 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
备注 : Use this View or other Views to search and navigate for the appropriate weakness.

备注

The relationships in this view were determined based on specific statements within the rules from the standard. Not all rules have direct relationships to individual weaknesses, although they likely have chaining relationships in specific circumstances.

目标受众

利益相关方 描述
Software Developers By following the CERT C Secure Coding Standard, developers will be able to fully or partially prevent the weaknesses that are identified in this view. In addition, developers can use a CWE coverage graph to determine which weaknesses are not directly addressed by the standard, which will help identify and resolve remaining gaps in training, tool acquisition, or other approaches for reducing weaknesses.
Product Customers If a software developer claims to be following the CERT C Secure Coding standard, then customers can search for the weaknesses in this view in order to formulate independent evidence of that claim.
Educators Educators can use this view in multiple ways. For example, if there is a focus on teaching weaknesses, the educator could link them to the relevant Secure Coding Standard.

提交记录

名称 组织 日期 发布日期 Version
CWE Content Team MITRE 2008-11-24 +00:00 2008-11-24 +00:00 1.1

修改记录

名称 组织 日期 备注
CWE Content Team MITRE 2017-11-08 +00:00 updated Description, Maintenance_Notes, Name, References
CWE Content Team MITRE 2019-01-03 +00:00 updated Description, Name, References
CWE Content Team MITRE 2020-02-24 +00:00 updated View_Audience
CWE Content Team MITRE 2021-03-15 +00:00 updated Description, Maintenance_Notes
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes

参考资料

REF-597

The CERT C Secure Coding Standard
Robert C. Seacord.

cvefind.com 上展示的信息来源于多个精心选择的权威数据源。CVE 数据由 MITRE Corporation 和 National Vulnerability Database (NVD) 提供。已知被利用漏洞（KEV）目录来源于 Cybersecurity and Infrastructure Security Agency (CISA)，EPSS 评分来自 FIRST.org。此外，软件弱点（CWE）和常见攻击模式（CAPEC）数据由 MITRE Corporation 维护，硬件和软件配置（CPE）信息由 NVD 提供。