JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

CodeSonar® 9.2p0 CONFIDENTIAL CodeSecure Inc
C and C++
Binaries

MISC.PWD.PLAINTRAN : Plaintext Transmission of Password

Summary

A password is transmitted without encryption, then subsequently used for authentication.

Properties

Class Name Plaintext Transmission of Password
Significance security
Mnemonic MISC.PWD.PLAINTRAN
Categories
MisraC++2023 MisraC++2023:0.3.2 A function call shall not violate the function's preconditions
CWE CWE:311 Missing Encryption of Sensitive Data
  CWE:319 Cleartext Transmission of Sensitive Information
CERT-C CERT-C:MSC18-C Be careful while handling sensitive data, such as passwords, in program code
DISA-6r1 DISA-6r1:V-222542 The application must only store cryptographic representations of passwords.
  DISA-6r1:V-222543 The application must transmit only cryptographically-protected passwords.
DISA-5r3 DISA-5r3:V-69567 The application must only store cryptographic representations of passwords.
  DISA-5r3:V-69569 The application must transmit only cryptographically-protected passwords.
DISA-4r3 DISA-4r3:V-69567 The application must only store cryptographic representations of passwords.
  DISA-4r3:V-69569 The application must transmit only cryptographically-protected passwords.
DISA-3r10 DISA-3r10:V-16796 The designer will ensure the application transmits account passwords in an approved encrypted format.
  DISA-3r10:V-16797 The designer will ensure the application stores account passwords in an approved encrypted format.
OWASP-2021 OWASP-2021:A2 Cryptographic failures
  OWASP-2021:A4 Insecure design
OWASP-2025 OWASP-2025:A04 Cryptographic Failures
  OWASP-2025:A06 Insecure Design
Availability Available for C and C++.
Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file. 
WARNING_FILTER += discard class="Plaintext Transmission of Password"

Example 

#include <windows.h>
#include <sys/socket.h>
#include <sql.h>
#include <sqlext.h>
#include <sqltypes.h>

int misc_pwd_plaintran(SQLCHAR *server_name, int sock ){
    RETCODE rc;
    HENV henv;
    HDBC hdbc;
    HSTMT hstmt;
    SQLCHAR uname[16];
    SQLCHAR passwd[32];

    if (recv(sock, uname, 16, 0) <= 0 ) return -1;
    if (recv(sock, passwd, 32, 0) <= 0 ) return -1;

    SQLAllocEnv(&henv);
    SQLAllocConnect(henv, &hdbc);
    if( !hdbc ) abort();
    rc = SQLConnectA(hdbc, /* "Plaintext Transmission of Password" warning issued here */
                     server_name, SQL_NTS,
                     uname, 16,
                     passwd, 32);
    /* remainder of function */
    exit(0);
}

Note that if the password argument to SQLConnectA() were specified as a literal string in the file (rather than being retrieved from a socket), CodeSonar would issue a Hardcoded Authentication warning instead.

Triggers

CodeSonar ships with library models that allow it to recognize functions such as Win32 LogonUserA()/LogonUserW() that can use a password for authentication. If one of these functions is called with a potentially-cleartext-transmitted value in the password parameter position, a warning will be issued.

If you have created a custom library model for some function f() in terms of one of these existing models, calls to f() will also be capable of triggering Plaintext Transmission of Password warnings.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.

 

To report problems with this documentation, please visit https://support.codesecure.com/.