Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler. Number of rules (primarily dangerous function names) in C/C++ ruleset: 223 Examining data/dtach-0.9/attach.c Examining data/dtach-0.9/dtach.h Examining data/dtach-0.9/master.c Examining data/dtach-0.9/main.c FINAL RESULTS: data/dtach-0.9/master.c:215:6: [5] (race) chmod: This accepts filename arguments; if an attacker can move those files, a race condition results. (CWE-362). Use fchmod( ) instead. if (chmod(name, 0600) < 0) data/dtach-0.9/master.c:239:3: [5] (race) chmod: This accepts filename arguments; if an attacker can move those files, a race condition results. (CWE-362). Use fchmod( ) instead. chmod(sockname, newmode); data/dtach-0.9/attach.c:65:2: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(sockun.sun_path, name); data/dtach-0.9/attach.c:92:3: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. printf(EOS "\r\n[detached]\r\n"); data/dtach-0.9/attach.c:94:3: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. printf(EOS "\r\n[got signal %d - dying]\r\n", sig); data/dtach-0.9/attach.c:119:3: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. printf(EOS "\r\n"); data/dtach-0.9/attach.c:137:3: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. printf(EOS "\r\n[detached]\r\n"); data/dtach-0.9/attach.c:242:4: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. printf(EOS "\r\n[select failed]\r\n"); data/dtach-0.9/attach.c:253:5: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. printf(EOS "\r\n[EOF - dtach terminating]" data/dtach-0.9/attach.c:259:5: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. printf(EOS "\r\n[read returned an error]\r\n"); data/dtach-0.9/master.c:126:3: [4] (shell) execvp: This causes a new program to execute and is difficult to use safely (CWE-78). try using a library call that implements the same functionality if available. execvp(*argv, argv); data/dtach-0.9/master.c:133:4: [4] (format) printf: If format strings can be influenced by an attacker, they can be exploited (CWE-134). Use a constant for the format specification. printf(EOS "\r\n"); data/dtach-0.9/master.c:198:2: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(sockun.sun_path, name); data/dtach-0.9/master.c:717:3: [4] (buffer) strcpy: Does not check for buffer overflows when copying to destination [MS-banned] (CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy easily misused). strcpy(name, buf); data/dtach-0.9/attach.c:152:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char buf[BUFSIZE]; data/dtach-0.9/attach.c:166:16: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). int dirfd = open(".", O_RDONLY); data/dtach-0.9/attach.c:311:16: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). int dirfd = open(".", O_RDONLY); data/dtach-0.9/dtach.h:113:12: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char buf[sizeof(struct winsize)]; data/dtach-0.9/master.c:146:19: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). the_pty.slave = open(buf, O_RDWR|O_NOCTTY); data/dtach-0.9/master.c:247:11: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. unsigned char buf[BUFSIZE]; data/dtach-0.9/master.c:480:11: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). nullfd = open("/dev/null", O_RDWR); data/dtach-0.9/master.c:574:16: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). int dirfd = open(".", O_RDONLY); data/dtach-0.9/master.c:649:3: [2] (buffer) char: Statically-sized arrays can be improperly restricted, leading to potential overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use functions that limit length, or ensure that the size is larger than the maximum possible length. char buf[1024]; data/dtach-0.9/master.c:680:11: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). master = open("/dev/ptc", O_RDWR|O_NOCTTY); data/dtach-0.9/master.c:687:10: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). slave = open(buf, O_RDWR|O_NOCTTY); data/dtach-0.9/master.c:691:11: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). master = open("/dev/ptmx", O_RDWR); data/dtach-0.9/master.c:702:10: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). slave = open(buf, O_RDWR|O_NOCTTY); data/dtach-0.9/master.c:757:8: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fd = open("/dev/tty", O_RDWR|O_NOCTTY); data/dtach-0.9/master.c:765:8: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fd = open(buf, O_RDWR); data/dtach-0.9/master.c:768:8: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fd = open("/dev/tty", O_WRONLY); data/dtach-0.9/master.c:779:8: [2] (misc) open: Check when opening files - can an attacker redirect it (via symlinks), force the opening of special file type (e.g., device files), move things around to create a race condition, control its ancestors, or change its contents? (CWE-362). fd = open(buf, O_RDWR); data/dtach-0.9/attach.c:55:6: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(name) > sizeof(sockun.sun_path) - 1) data/dtach-0.9/attach.c:249:18: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). ssize_t len = read(s, buf, sizeof(buf)); data/dtach-0.9/attach.c:273:10: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). len = read(0, pkt.u.buf, sizeof(pkt.u.buf)); data/dtach-0.9/attach.c:342:9: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). len = read(0, pkt.u.buf, sizeof(pkt.u.buf)); data/dtach-0.9/main.c:99:32: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strncmp(*argv, "--help", strlen(*argv)) == 0) data/dtach-0.9/main.c:101:40: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). else if (strncmp(*argv, "--version", strlen(*argv)) == 0) data/dtach-0.9/master.c:188:6: [1] (buffer) strlen: Does not handle strings that are not \0-terminated; if given one it may perform an over-read (it could cause a crash if unprotected) (CWE-126). if (strlen(name) > sizeof(sockun.sun_path) - 1) data/dtach-0.9/master.c:254:8: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). len = read(the_pty.fd, buf, sizeof(buf)); data/dtach-0.9/master.c:362:8: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). len = read(p->fd, &pkt, sizeof(struct packet)); data/dtach-0.9/master.c:653:9: [1] (buffer) read: Check buffer boundaries if used in a loop including recursive loops (CWE-120, CWE-20). len = read(fd[0], buf, sizeof(buf)); ANALYSIS SUMMARY: Hits = 41 Lines analyzed = 1582 in approximately 0.07 seconds (22460 lines/second) Physical Source Lines of Code (SLOC) = 1174 Hits@level = [0] 33 [1] 10 [2] 17 [3] 0 [4] 12 [5] 2 Hits@level+ = [0+] 74 [1+] 41 [2+] 31 [3+] 14 [4+] 14 [5+] 2 Hits/KSLOC@level+ = [0+] 63.0324 [1+] 34.9233 [2+] 26.4055 [3+] 11.925 [4+] 11.925 [5+] 1.70358 Dot directories skipped = 1 (--followdotdir overrides) Minimum risk level = 1 Not every hit is necessarily a security vulnerability. There may be other security vulnerabilities; review your code! See 'Secure Programming HOWTO' (https://dwheeler.com/secure-programs) for more information.