FXCop addresses Security vulnerabilities?

Question

I'm new to FxCop. Does FXCop addresses the following list of vulnerabilities?

1. Buffer Overflow Detection  
2. Access Control Analysis 
3. Format String Issues Detection 
4. Dangerous Function/Method Calls Detection 
5. Thread Safety Race Conditions Detection 
6. Encryption and RNG Misuse Detection 
7. Input Validation Analysis 
8. Cross Site Scripting Detection 
9. SQL Injection Detection 
10. Command Injection Detection 
11. Inter-Process Race Conditions Detection 
12. Logging Practices Analysis 
13. Enforcement of Best Practices for Secure Coding 
14. Web Services Review Capability 
15. Data Flow Analysis Capability 
16. Control Flow Analysis Capability 
17. Semantic Analysis Capability 

Answer 1

FxCop has (limited) format string issue detection, mostly in the area of correctness (ie, it detects string format patterns that will raise a runtime exception). FxCop does check for some usage of problematic API (but not all known problematic managed methods. We don't flag Assembly.LoadFrom usage, for example). FxCop's security rules capture some best practices for secure managed binaries. FxCop has control and data flow analysis capability (analysis is restricted to a method body). FxCop provides a type-system view of assemblies and multiple abstractions for IL, but does not provide a source-level semantic analysis.

Hope this is useful,
Michael Fanning
VSTS Development: Code Analysis

Answer 2

Thank you. I really appreciated you taking time to response to my qustions. I'll download this tool and try it out.