Book a Security Review

Weakness · Medium

CWE-477: Use of Obsolete Function

What it is

The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.

MITRE CWE 4.19.1

Severity (our rating)
Medium
Likelihood of exploit
Not rated by MITRE
Introduced during
Implementation
Exploited in the wild
No CVE in CISA's catalog

In more detail

As programming languages evolve, functions occasionally become obsolete due to: Advances in the language Improved understanding of how operations should be performed effectively and securely Changes in the conventions that govern certain operations Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.

What an attacker can do

  • Quality Degradation (Other)

How to prevent it

Implementation

  • Refer to the documentation for the obsolete function in order to determine why it is deprecated or obsolete and to learn about alternative ways to achieve the same functionality.

Requirements

  • Consider seriously the security implications of using an obsolete function. Consider using alternate functions.

How to find it

  • Automated Static Analysis - Binary or Bytecode. According to SOAR, the following detection techniques may be useful: Highly cost effective: Binary / Bytecode Quality Analysis Cost effective for partial coverage: Bytecode Weakness Analysis - including disassembler + source code weakness analysis
  • Manual Static Analysis - Binary or Bytecode. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
  • Dynamic Analysis with Manual Results Interpretation. According to SOAR, the following detection techniques may be useful: Highly cost effective: Debugger
  • Manual Static Analysis - Source Code. According to SOAR, the following detection techniques may be useful: Highly cost effective: Manual Source Code Review (not inspections) Cost effective for partial coverage: Focused Manual Spotcheck - Focused manual analysis of source
  • Automated Static Analysis - Source Code. According to SOAR, the following detection techniques may be useful: Highly cost effective: Source Code Quality Analyzer Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer
  • Automated Static Analysis. According to SOAR, the following detection techniques may be useful: Highly cost effective: Origin Analysis
  • Architecture or Design Review. According to SOAR, the following detection techniques may be useful: Highly cost effective: Formal Methods / Correct-By-Construction Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)

CWE-477 on MITRE's CWE site

H2 Security

Found it in your code?

We review where it appears, fix it with your team, and check it was not already used against you.

Talk to our team

T Academy

Stop writing it in the first place

Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.

Start free

Source: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.