CWE-477 对废弃函数的使用 类漏洞列表 15

The following code uses the deprecated function getpw() to verify that a plaintext password matches a user's encrypted password. If the password is valid, the function sets result to 1; otherwise it is set to 0.

... getpw(uid, pwdline); for (i=0; i<3; i++){ cryptpw=strtok(pwdline, ":"); pwdline=0; } result = strcmp(crypt(plainpw,cryptpw), cryptpw) == 0; ...

In the following code, the programmer assumes that the system always has a property named "cmd" defined. If an attacker can control the program's environment so that "cmd" is not defined, the program throws a null pointer exception when it attempts to call the "Trim()" method.

String cmd = null; ... cmd = Environment.GetEnvironmentVariable("cmd"); cmd = cmd.Trim();