title: How can a Format-String vulnerability be exploited?
body: <p>I was reading about vulnerabilities in code and came across this <em>Format-String Vulnerability</em>. </p>
  
  <p><a href="http://en.wikipedia.org/wiki/Uncontrolled_format_string" rel="noreferrer">Wikipedia</a> says:</p>
  
  <blockquote>
    <p>Format string bugs most commonly appear when a programmer wishes to
    print a string containing user supplied data. The programmer may
    mistakenly write printf(buffer) instead of printf("%s", buffer). The
    first version interprets buffer as a format string, and parses any
    formatting instructions it may contain. The second version simply
    prints a string to the screen, as the programmer intended.</p>
  </blockquote>
  
  <p>I got the problem with printf(buffer) version, but I still didn't get how this vulnerability can be used by attacker to execute harmful code. Can someone please tell me how this vulnerability can be <strong>exploited</strong> by an example?</p>