Format string attacks are a new class of vulnerabilities discovered in June of 2000 previously thought harmless. Format string attacks can be used to crash a program or to execute harmful code. The problem stems from the use of unfiltered user input as the format string parameter in certain C functions that perform formatting, such as printf(). A malicious user may use the %s and %x format tokens, among others, to print data from the stack or possibly other locations in memory. One may also write arbitrary data to arbitrary locations using the %n format token, which commands printf() and similar functions to write back the number of bytes formatted to the same argument to printf(), assuming that the corresponding argument exists, and is of type int * .
This is a common vulnerability due to the fact that format bugs were previously thought harmless and resulted in vulnerabilites in many common tools. MITRE's CVE project (http://www.cve.mitre.org/cgi-bin/cvekey.cgi?keyword=format+string) list roughly 150 vulnerable programs.
Format string bugs most commonly appear when a programmer wishes to print a string containing user supplied data. The programmer may mistakenly write printf(buffer) instead of printf("%s", buffer). The first version interprets buffer as a format string, and parses any formatting instructions it may contain. The second version simply prints a string to the screen, as the programmer intended.
Format bugs arise because C's argument passing conventions are type-unsafe. In particular, the varargs mechanism allows functions to accept any number of arguments (e.g. printf) by "popping" as many arguments off the call stack as they wish, trusting the early arguments to indicate how many additional arguments are to be popped, and of what types.
See also
fprintf
sprintf
snprintf
syslog
References
Tobias Klein: Buffer Overflows und Format-String-Schwachstellen, Dpunkt Verlag, ISBN 3-89864-192-9
External links
Exploiting Format String Vulnerabilities (http://teso.scene.at/articles/formatstring/)
Formatting means to take some data and prepare it for display or printing, but the formatting instructions are so flexible that some attackers have found ways of using formatting to write to memory.
Formatstringattacks usually add a single address in memory that points to another address in memory where the attacker has added new instructions to execute.
Feeds |
Contact