繁體中文

CWE-734 檢視詳細資料

CWE-734

Weaknesses Addressed by the CERT C Secure Coding Standard (2008)
2008-11-24 +00:00
Obsolete
Graph
2023-06-29 +00:00
CWE Mitre.org
指定 CWE 通知
掌握特定 CWE 的任何變更。
管理通知

名稱: Weaknesses Addressed by the CERT C Secure Coding Standard (2008)

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.

CWE 成員

CWE-743: Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer 基礎
CWE-134: Use of Externally-Controlled Format String 基礎
CWE-22: Improper Limitation of a Pathname to a Restricted Directory 基礎
CWE-241: Improper Handling of Unexpected Data Type 基礎
CWE-276: Incorrect Default Permissions 基礎
CWE-279: Incorrect Execution-Assigned Permissions 基礎
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 基礎
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition 基礎
CWE-37: Path Traversal: '/absolute/pathname/here' 基礎
CWE-379: Creation of Temporary File in Directory with Insecure Permissions 基礎
CWE-38: Path Traversal: '\absolute\pathname\here' 基礎
CWE-39: Path Traversal: 'C:dirname' 基礎
CWE-391: DEPRECATED: Unchecked Error Condition 基礎
CWE-403: Exposure of File Descriptor to Unintended Control Sphere 基礎
CWE-404: Improper Resource Shutdown or Release 基礎
CWE-41: Improper Resolution of Path Equivalence 基礎
CWE-552: Files or Directories Accessible to External Parties 基礎
CWE-59: Improper Link Resolution Before File Access 基礎
CWE-62: UNIX Hard Link 基礎
CWE-64: Windows Shortcut Following (.LNK) 基礎
CWE-65: Windows Hard Link 基礎
CWE-67: Improper Handling of Windows Device Names 基礎
CWE-675: Multiple Operations on Resource in Single-Operation Context 基礎
CWE-676: Use of Potentially Dangerous Function 基礎
CWE-686: Function Call With Incorrect Argument Type 基礎
CWE-732: Incorrect Permission Assignment for Critical Resource 基礎

CWE 檢視資訊

漏洞對應備注

理由說明 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
備註 : Use this View or other Views to search and navigate for the appropriate weakness.

備注

The relationships in this view were determined based on specific statements within the rules from the standard. Not all rules have direct relationships to individual weaknesses, although they likely have chaining relationships in specific circumstances.

受眾

相關方 描述
Software Developers By following the CERT C Secure Coding Standard, developers will be able to fully or partially prevent the weaknesses that are identified in this view. In addition, developers can use a CWE coverage graph to determine which weaknesses are not directly addressed by the standard, which will help identify and resolve remaining gaps in training, tool acquisition, or other approaches for reducing weaknesses.
Product Customers If a software developer claims to be following the CERT C Secure Coding standard, then customers can search for the weaknesses in this view in order to formulate independent evidence of that claim.
Educators Educators can use this view in multiple ways. For example, if there is a focus on teaching weaknesses, the educator could link them to the relevant Secure Coding Standard.

提交

名稱 機構 日期 發布日期 Version
CWE Content Team MITRE 2008-11-24 +00:00 2008-11-24 +00:00 1.1

修改記錄

名稱 機構 日期 備註
CWE Content Team MITRE 2017-11-08 +00:00 updated Description, Maintenance_Notes, Name, References
CWE Content Team MITRE 2019-01-03 +00:00 updated Description, Name, References
CWE Content Team MITRE 2020-02-24 +00:00 updated View_Audience
CWE Content Team MITRE 2021-03-15 +00:00 updated Description, Maintenance_Notes
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes

參考資料

REF-597

The CERT C Secure Coding Standard
Robert C. Seacord.

cvefind.com 上呈現的資訊來自多個精心挑選的參考來源。CVE 資料由 MITRE Corporation 和 國家漏洞資料庫（NVD）提供。已知被利用漏洞（KEV）目錄來自 網路安全暨基礎設施安全局（CISA），而 EPSS 評分來自 FIRST.org。此外，軟體弱點（CWE）和常見攻擊模式（CAPEC）的資料由 MITRE Corporation 維護，硬軟體配置（CPE）資訊由 NVD 提供。