For each code specify:

What data is being exposed and how?

What line(s) in the source present the vulnerability?

Describe how you would fix the vulnerable code.

CWE615_Info_Exposure.c

#include "std_testcase.h"

#include #pragma comment(lib, "advapi32.lib")

#define PASSWORD "ABCD1234!" #define USERNAME "XXXXX Smith!"

void CWE615_Info_Exposure_bad() { int j; for(j = 0; j < 1; j++) { { size_t passwordLen = 0; HANDLE hUser; char * domain = "Domain"; /* Use the password in LogonUser() to establish that it is "sensitive" */ if (LogonUserA( USERNAME, domain, PASSWORD, LOGON32_LOGON_NETWORK, LOGON32_PROVIDER_DEFAULT, &hUser) != 0) { /* Logged in XXXXX Smith using password ABCD1234 */ printLine("User logged in successfully" ); CloseHandle(hUser); } else { printLine("Unable to login."); } } } }

int main(int argc, char * argv[]) { /* seed randomness */ srand( (unsigned)time(NULL) ); #ifndef OMITGOOD printLine("Calling good()..."); CWE615_Info_Exposure_good(); printLine("Finished good()"); #endif /* OMITGOOD */ #ifndef OMITBAD printLine("Calling bad()..."); CWE615_Info_Exposure_bad(); printLine("Finished bad()"); #endif /* OMITBAD */ return 0; }

CWE535_Info_Exposure_Shell.c

#include "std_testcase.h"

#include

#include #pragma comment(lib, "advapi32.lib")

void CWE535_Info_Exposure_Shell_bad() { int j; for(j = 0; j < 1; j++) { { wchar_t password[100] = L""; size_t passwordLen = 0; HANDLE pHandle; wchar_t * username = L"User"; wchar_t * domain = L"Domain"; if (fgetws(password, 100, stdin) == NULL) { printLine("fgetws() failed"); /* Restore NUL terminator if fgetws fails */ password[0] = L'\0'; } /* Remove the carriage return from the string that is inserted by fgetws() */ passwordLen = wcslen(password); if (passwordLen > 0) { password[passwordLen-1] = L'\0'; } /* Use the password in LogonUser() to establish that it is "sensitive" */ if (LogonUserW( username, domain, password, LOGON32_LOGON_NETWORK, LOGON32_PROVIDER_DEFAULT, &pHandle) != 0) { printLine("User logged in successfully."); CloseHandle(pHandle); } else { printLine("Unable to login."); } fwprintf(stderr, L"User attempted access with password: %s ", password); } } }

int main(int argc, char * argv[]) { /* seed randomness */ srand( (unsigned)time(NULL) ); #ifndef OMITGOOD printLine("Calling good()..."); CWE535_Info_Exposure_Shell_good(); printLine("Finished good()"); #endif /* OMITGOOD */ #ifndef OMITBAD printLine("Calling bad()..."); CWE535_Info_Exposure_Shell_bad(); printLine("Finished bad()"); #endif /* OMITBAD */ return 0; }

#endif

CWE534_Info_Exposure_Debug.c

#include "std_testcase.h"

#include

#include #pragma comment(lib, "advapi32.lib")

#ifndef OMITBAD

void CWE534_Info_Exposure_Debug_bad() { int j; for(j = 0; j < 1; j++) { { wchar_t password[100] = L""; size_t passwordLen = 0; HANDLE pHandle; wchar_t * username = L"User"; wchar_t * domain = L"Domain"; FILE * pFile = fopen("debug.txt", "a+"); if (fgetws(password, 100, stdin) == NULL) { printLine("fgetws() failed"); /* Restore NUL terminator if fgetws fails */ password[0] = L'\0'; } /* Remove the carriage return from the string that is inserted by fgetws() */ passwordLen = wcslen(password); if (passwordLen > 0) { password[passwordLen-1] = L'\0'; } /* Use the password in LogonUser() to establish that it is "sensitive" */ if (LogonUserW( username, domain, password, LOGON32_LOGON_NETWORK, LOGON32_PROVIDER_DEFAULT, &pHandle) != 0) { printLine("User logged in successfully."); CloseHandle(pHandle); } else { printLine("Unable to login."); } fwprintf(pFile, L"User attempted access with password: %s ", password); if (pFile) { fclose(pFile); } } } }

int main(int argc, char * argv[]) { /* seed randomness */ srand( (unsigned)time(NULL) ); #ifndef OMITGOOD printLine("Calling good()..."); CWE534_Info_Exposure_Debug_good(); printLine("Finished good()"); #endif /* OMITGOOD */ #ifndef OMITBAD printLine("Calling bad()..."); CWE534_Info_Exposure_Debug_bad(); printLine("Finished bad()"); #endif /* OMITBAD */ return 0; }

#endif

CWE226_Sensitive_Information.c

#include "std_testcase.h"

#include #include #pragma comment(lib, "advapi32.lib")

#ifndef OMITBAD

void CWE226_Sensitive_Information_bad() { int j; for(j = 0; j < 1; j++) { { wchar_t password[100] = L""; size_t passwordLen = 0; HANDLE hUser; wchar_t * username = L"User"; wchar_t * domain = L"Domain"; if (fgetws(password, 100, stdin) == NULL) { printLine("fgetws() failed"); /* Restore NUL terminator if fgetws fails */ password[0] = L'\0'; } /* Remove the carriage return from the string that is inserted by fgetws() */ passwordLen = wcslen(password); if (passwordLen > 0) { password[passwordLen-1] = L'\0'; } /* Use the password in LogonUser() to establish that it is "sensitive" */ if (LogonUserW( username, domain, password, LOGON32_LOGON_NETWORK, LOGON32_PROVIDER_DEFAULT, &hUser) != 0) { printLine("User logged in successfully."); CloseHandle(hUser); } else { printLine("Unable to login."); } } } }

#ifdef INCLUDEMAIN

int main(int argc, char * argv[]) { /* seed randomness */ srand( (unsigned)time(NULL) ); #ifndef OMITGOOD printLine("Calling good()..."); CWE226_Sensitive_Information_good(); printLine("Finished good()"); #endif /* OMITGOOD */ #ifndef OMITBAD printLine("Calling bad()..."); CWE226_Sensitive_Information_bad(); printLine("Finished bad()"); #endif /* OMITBAD */ return 0; }

#endif