Weekly Edition
Return to the Security page
| |||||||||||||
|
| |||||||||||||
Flawfinder 1.20, a security auditing tool for C/C++
David A. Wheeler has released Flawfinder
version 1.20,
"a
tool that examines C/C++ code and reports possible security flaws
in the code (sorted by risk level)."
Flawfinder works by using a built-in database of C/C++ functions with well-known problems,
such as buffer overflow risks (e.g., strcpy(), strcat(), gets(), sprintf(), and the scanf() family),
format string problems ([v][f]printf(), [v]snprintf(), and syslog()), race conditions (such as access(),
chown(), chgrp(), chmod(), tmpfile(), tmpnam(), tempnam(), and mktemp()), potential shell metacharacter
dangers (most of the exec() family, system(), popen()), and poor random number acquisition (such as random()).
(Log in to post comments)
|
|
||||||||||||