JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

CodeSonar® 9.2p0 CONFIDENTIAL CodeSecure Inc
C and C++
Binaries

MISC.PWD.PLAINTRAN : 平文で送信されるパスワード

要旨

パスワードが暗号化なしに送信され、その後認証に使用されています。

プロパティ

クラス名 Plaintext Transmission of Password
日本語クラス名 平文で送信されるパスワード
クラス分類 セキュリティ (security)
ニーモニック MISC.PWD.PLAINTRAN
カテゴリー
MisraC++2023 MisraC++2023:0.3.2 A function call shall not violate the function's preconditions
CWE CWE:311 Missing Encryption of Sensitive Data
  CWE:319 Cleartext Transmission of Sensitive Information
CERT-C CERT-C:MSC18-C Be careful while handling sensitive data, such as passwords, in program code
DISA-6r1 DISA-6r1:V-222542 The application must only store cryptographic representations of passwords.
  DISA-6r1:V-222543 The application must transmit only cryptographically-protected passwords.
DISA-5r3 DISA-5r3:V-69567 The application must only store cryptographic representations of passwords.
  DISA-5r3:V-69569 The application must transmit only cryptographically-protected passwords.
DISA-4r3 DISA-4r3:V-69567 The application must only store cryptographic representations of passwords.
  DISA-4r3:V-69569 The application must transmit only cryptographically-protected passwords.
DISA-3r10 DISA-3r10:V-16796 The designer will ensure the application transmits account passwords in an approved encrypted format.
  DISA-3r10:V-16797 The designer will ensure the application stores account passwords in an approved encrypted format.
OWASP-2021 OWASP-2021:A2 Cryptographic failures
  OWASP-2021:A4 Insecure design
OWASP-2025 OWASP-2025:A04 Cryptographic Failures
  OWASP-2025:A06 Insecure Design
対応言語 C および C++ で利用可能です。
有効/無効設定 このワーニングクラスのチェックはデフォルトで有効になっています。チェックを無効にするにはプロジェクト設定ファイル （configuration file）に以下の WARNING_FILTER ルールを追加してください。 
WARNING_FILTER += discard class="Plaintext Transmission of Password"

例 

#include <windows.h>
#include <sys/socket.h>
#include <sql.h>
#include <sqlext.h>
#include <sqltypes.h>

int misc_pwd_plaintran(SQLCHAR *server_name, int sock ){
    RETCODE rc;
    HENV henv;
    HDBC hdbc;
    HSTMT hstmt;
    SQLCHAR uname[16];
    SQLCHAR passwd[32];

    if (recv(sock, uname, 16, 0) <= 0 ) return -1;
    if (recv(sock, passwd, 32, 0) <= 0 ) return -1;

    SQLAllocEnv(&henv);
    SQLAllocConnect(henv, &hdbc);
    if( !hdbc ) abort();
    rc = SQLConnectA(hdbc, /* "Plaintext Transmission of Password" warning issued here */
                     server_name, SQL_NTS,
                     uname, 16,
                     passwd, 32);
    /* remainder of function */
    exit(0);
}

SQLConnectA() へのパスワード引数が、ソケットから取り出されるのではなく文字列リテラルとしてファイル内で指定される場合には、代わりにハードコードされた認証値( Hardcoded Authentication)のワーニングを検出します。

ワーニングを引き起こす関数

CodeSonar ships with library models that allow it to functions such as Win32 LogonUserA()/LogonUserW() that can use a password for authentication. If one of these functions is called with a potentially-cleartext-transmitted value in the password parameter position, a warning will be issued.

If you have created a custom library model for some function f() in terms of one of these existing models, calls to f() will also be capable of triggering Plaintext Transmission of Password warnings.

関連のある設定ファイルパラメータ

設定ファイルの以下のパラメータがこのワーニングクラスのチェックに影響します。

 

To report problems with this documentation, please visit https://support.codesecure.com/.