CWE-477: Use of Obsolete Function

Description:
The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.

Extended Description:
As programming languages evolve, functions occasionally become obsolete due to: 
                
                   Advances in the language 
                   Improved understanding of how operations should be performed effectively and securely 
                   Changes in the conventions that govern certain operations 
                
             Functions that are removed are usually replaced by newer counterparts that perform the same task in some different and hopefully improved way.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-710

Consequences:
  - Other: Quality Degradation

Detection methods:
  - Automated Static Analysis - Binary or Bytecode: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Highly cost effective: 
                         
                           
  - Manual Static Analysis - Binary or Bytecode: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             
  - Dynamic Analysis with Manual Results Interpretation: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Highly cost effective: 
                         
                           
  - Manual Static Analysis - Source Code: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Highly cost effective: 
                         
                           

Mitigations:
  - [Implementation] Refer to the documentation for the obsolete function in order to determine why it is deprecated or obsolete and to learn about alternative ways to achieve the same functionality.
  - [Requirements] Consider seriously the security implications of using an obsolete function. Consider using alternate functions.

Demonstrative examples:
The following code uses the deprecated function getpw() to verify that a plaintext password matches a user's encrypted password. If the password is valid, the function sets result to 1; otherwise it is set to 0.
Although the code often behaves correctly, using the getpw() function can be problematic from a security standpoint, because it can overflow the buffer passed to its second parameter. Because of this vulnerability, getpw() has been supplanted by getpwuid(), which performs the same lookup as getpw() but returns a pointer to a statically-allocated structure to mitigate the risk. Not all functions are deprecated or replaced because they pose a security risk. However, the presence of an obsolete function often indicates that the surrounding code has been neglected and may be in a state

In the following code, the programmer assumes that the system always has a property named "cmd" defined. If an attacker can control the program's environment so that "cmd" is not defined, the program throws a null pointer exception when it attempts to call the "Trim()" method.

String cmd = null; ... cmd = Environment.GetEnvironmentVariable("cmd"); cmd = cmd.Trim();