Flawfinder version 2.0.10, (C) 2001-2019 David A. Wheeler.
Number of rules (primarily dangerous function names) in C/C++ ruleset: 223
Examining data/rungetty-1.2/rungetty.c
FINAL RESULTS:
data/rungetty-1.2/rungetty.c:448:7: [5] (race) chown:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchown( ) instead.
if (chown (buf, 0, 0) || chmod (buf, 0600))
data/rungetty-1.2/rungetty.c:448:28: [5] (race) chmod:
This accepts filename arguments; if an attacker can move those files, a
race condition results. (CWE-362). Use fchmod( ) instead.
if (chown (buf, 0, 0) || chmod (buf, 0600))
data/rungetty-1.2/rungetty.c:130:3: [4] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused).
strcpy (buf, progname);
data/rungetty-1.2/rungetty.c:136:3: [4] (format) vsprintf:
Potential format string problem (CWE-134). Make format string constant.
vsprintf (bp, fmt, va_alist);
data/rungetty-1.2/rungetty.c:141:3: [4] (format) syslog:
If syslog's format strings can be influenced by an attacker, they can be
exploited (CWE-134). Use a constant format string for syslog.
syslog (LOG_ERR, buf);
data/rungetty-1.2/rungetty.c:426:7: [4] (shell) execl:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
execl (_PATH_LOGIN, _PATH_LOGIN, "-f", autologin_name, NULL);
data/rungetty-1.2/rungetty.c:431:7: [4] (shell) execl:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
execl (_PATH_LOGIN, _PATH_LOGIN, "--", logname, NULL);
data/rungetty-1.2/rungetty.c:447:3: [4] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused).
strcat (buf, tty);
data/rungetty-1.2/rungetty.c:608:3: [4] (shell) execvp:
This causes a new program to execute and is difficult to use safely
(CWE-78). try using a library call that implements the same functionality
if available.
execvp (program_run, &argv[optind + 1]);
data/rungetty-1.2/rungetty.c:534:15: [3] (buffer) getopt_long:
Some older implementations do not protect against internal buffer overflows
(CWE-120, CWE-20). Check implementation on installation, or limit the size
of all string inputs.
while ((c = getopt_long (argc, argv, "d:n:u:w:g:", long_options, (int *) 0)) != EOF)
data/rungetty-1.2/rungetty.c:79:8: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char hn[MAXHOSTNAMELEN + 1];
data/rungetty-1.2/rungetty.c:122:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[256], *bp;
data/rungetty-1.2/rungetty.c:131:3: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat (buf, ": ");
data/rungetty-1.2/rungetty.c:144:3: [2] (buffer) strcat:
Does not check for buffer overflows when concatenating to destination
[MS-banned] (CWE-120). Consider using strcat_s, strncat, strlcat, or
snprintf (warning: strncat is easily misused). Risk is low because the
source is a constant string.
strcat (bp, "\r\n");
data/rungetty-1.2/rungetty.c:145:13: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fd = open ("/dev/console", 1)) >= 0)
data/rungetty-1.2/rungetty.c:200:16: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((ut_fd = open (_PATH_WTMP, O_APPEND | O_WRONLY)) >= 0)
data/rungetty-1.2/rungetty.c:242:2: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buff[20];
data/rungetty-1.2/rungetty.c:281:13: [2] (misc) fopen:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fd = fopen (ISSUE, "r")))
data/rungetty-1.2/rungetty.c:301:10: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
static char logname[40];
data/rungetty-1.2/rungetty.c:356:13: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fd = open ("/dev/console", 1)) >= 0)
data/rungetty-1.2/rungetty.c:412:13: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fd = open (AUTO_LAST, O_WRONLY | O_CREAT | O_TRUNC, 0644)) < 0)
data/rungetty-1.2/rungetty.c:442:3: [2] (buffer) char:
Statically-sized arrays can be improperly restricted, leading to potential
overflows or other issues (CWE-119!/CWE-120). Perform bounds checking, use
functions that limit length, or ensure that the size is larger than the
maximum possible length.
char buf[20];
data/rungetty-1.2/rungetty.c:446:3: [2] (buffer) strcpy:
Does not check for buffer overflows when copying to destination [MS-banned]
(CWE-120). Consider using snprintf, strcpy_s, or strlcpy (warning: strncpy
easily misused). Risk is low because the source is a constant string.
strcpy (buf, "/dev/");
data/rungetty-1.2/rungetty.c:462:13: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if ((fd = open (buf, O_RDWR, 0)) < 0
data/rungetty-1.2/rungetty.c:476:7: [2] (misc) open:
Check when opening files - can an attacker redirect it (via symlinks),
force the opening of special file type (e.g., device files), move things
around to create a race condition, control its ancestors, or change its
contents? (CWE-362).
if (open (buf, O_RDWR, 0) != 0)
data/rungetty-1.2/rungetty.c:544:12: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
delay = atoi (optarg);
data/rungetty-1.2/rungetty.c:550:15: [2] (integer) atoi:
Unless checked, the resulting number can exceed the expected range
(CWE-190). If source untrusted, check both minimum and maximum, even if the
input had no minus sign (large numbers can roll over into negative number;
consider saving to an unsigned value if that is intended).
priority = atoi (optarg);
data/rungetty-1.2/rungetty.c:132:14: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
bp = buf + strlen (buf);
data/rungetty-1.2/rungetty.c:147:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
write (fd, buf, strlen (buf));
data/rungetty-1.2/rungetty.c:187:7: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy (ut.ut_id, tty + 3, sizeof (ut.ut_id));
data/rungetty-1.2/rungetty.c:191:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120). Risk is low because the source is a
constant string.
strncpy (ut.ut_user, "LOGIN", sizeof (ut.ut_user));
data/rungetty-1.2/rungetty.c:192:3: [1] (buffer) strncpy:
Easily used incorrectly; doesn't always \0-terminate or check for invalid
pointers [MS-banned] (CWE-120).
strncpy (ut.ut_line, tty, sizeof (ut.ut_line));
data/rungetty-1.2/rungetty.c:283:19: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
while ((c = getc (fd)) != EOF)
data/rungetty-1.2/rungetty.c:286:27: [1] (buffer) getc:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
output_special_char (getc (fd));
data/rungetty-1.2/rungetty.c:293:17: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
write (1, hn, strlen (hn));
data/rungetty-1.2/rungetty.c:312:8: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
if (read (0, &c, 1) < 1)
data/rungetty-1.2/rungetty.c:358:23: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
write (fd, buf, strlen (buf));
data/rungetty-1.2/rungetty.c:496:25: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
write (1, prompt, strlen (prompt));
data/rungetty-1.2/rungetty.c:500:27: [1] (buffer) strlen:
Does not handle strings that are not \0-terminated; if given one it may
perform an over-read (it could cause a crash if unprotected) (CWE-126).
write (1, program_run, strlen (program_run));
data/rungetty-1.2/rungetty.c:504:7: [1] (buffer) read:
Check buffer boundaries if used in a loop including recursive loops
(CWE-120, CWE-20).
read (0, buf, 1);
ANALYSIS SUMMARY:
Hits = 40
Lines analyzed = 611 in approximately 0.03 seconds (23401 lines/second)
Physical Source Lines of Code (SLOC) = 437
Hits@level = [0] 12 [1] 13 [2] 17 [3] 1 [4] 7 [5] 2
Hits@level+ = [0+] 52 [1+] 40 [2+] 27 [3+] 10 [4+] 9 [5+] 2
Hits/KSLOC@level+ = [0+] 118.993 [1+] 91.5332 [2+] 61.7849 [3+] 22.8833 [4+] 20.595 [5+] 4.57666
Dot directories skipped = 1 (--followdotdir overrides)
Minimum risk level = 1
Not every hit is necessarily a security vulnerability.
There may be other security vulnerabilities; review your code!
See 'Secure Programming HOWTO'
(https://dwheeler.com/secure-programs) for more information.