The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
N/A
Threat Mapped score: 1.8
Industry: Finiancial
Threat priority: P4 - Informational (Low)
CVE: CVE-2002-1825
format string in Perl program
CVE: CVE-2001-0717
format string in bad call to syslog function
CVE: CVE-2002-0573
format string in bad call to syslog function
CVE: CVE-2002-1788
format strings in NNTP server responses
CVE: CVE-2006-2480
Format string vulnerability exploited by triggering errors or warnings, as demonstrated via format string specifiers in a .bmp filename.
CVE: CVE-2007-2027
Chain: untrusted search path enabling resultant format string by loading malicious internationalization messages
N/A
| Phase | Note |
|---|---|
| Implementation | The programmer rarely intends for a format string to be externally-controlled at all. This weakness is frequently introduced in code that constructs log messages, where a constant format string is omitted. |
| Implementation | In cases such as localization and internationalization, the language-specific message repositories could be an avenue for exploitation, but the format string issue would be resultant, since attacker control of those repositories would also allow modification of message length, format, and content. |
Intro: The following program prints a string provided as an argument.
Body: The example is exploitable, because of the call to printf() in the printWrapper() function. Note: The stack buffer was added to make exploitation more simple.
#include <stdio.h> void printWrapper(char *string) { printf(string); } int main(int argc, char **argv) { char buf[5012]; memcpy(buf, argv[1], 5012); printWrapper(argv[1]); return (0); }Intro: The following code copies a command line argument into a buffer using snprintf().
Body: This code allows an attacker to view the contents of the stack and write to the stack using a command line argument containing a sequence of formatting directives. The attacker can read from the stack by providing more formatting directives, such as %x, than the function takes as arguments to be formatted. (In this example, the function takes no arguments to be formatted.) By using the %n formatting directive, the attacker can write to the stack, causing snprintf() to write the number of bytes output thus far to the specified argument (rather than reading a value from the argument, which is the intended behavior). A sophisticated version of this attack will use four staggered writes to completely control the value of a pointer on the stack.
int main(int argc, char **argv){ char buf[128]; ... snprintf(buf,128,argv[1]); }Intro: Certain implementations make more advanced attacks even easier by providing format directives that control the location in memory to read from or write to. An example of these directives is shown in the following code, written for glibc:
Body: This code produces the following output: 5 9 5 5 It is also possible to use half-writes (%hn) to accurately control arbitrary DWORDS in memory, which greatly reduces the complexity needed to execute an attack that would otherwise require four staggered writes, such as the one mentioned in a separate example.
printf("%d %d %1$d %1$d\n", 5, 9);