366
Language : C++ (Prevalence = Often)
Language : Perl (Prevalence = Rarely)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Confidentiality Read Memory
Format string problems allow for information disclosure
which can severely simplify exploitation of the program.
Integrity
Confidentiality
Availability
Modify Memory
Execute Unauthorized Code or Commands
Format string problems can result in the execution of
arbitrary code.
Detection Methods
Automated Static Analysis
This weakness can often be detected using automated static analysis tools. Many modern tools
use data flow analysis or constraint-based techniques to minimize the number of false positives.
Black Box
Since format strings often occur in rarely-occurring erroneous conditions (e.g. for error message
logging), they can be difficult to detect using black box methods. It is highly likely that many latent
issues exist in executables that do not have associated source code (or equivalent source.
Effectiveness = Limited
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Bytecode Weakness Analysis - including disassembler + source code weakness analysis Binary
Weakness Analysis - including disassembler + source code weakness analysis Cost effective for
partial coverage: Binary / Bytecode simple extractor - strings, ELF readers, etc.
Effectiveness = High
Manual Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities &
anomalies
Effectiveness = SOAR Partial
Dynamic Analysis with Automated Results Interpretation
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Web Application Scanner Web Services Scanner Database Scanners
Effectiveness = SOAR Partial
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Fuzz Tester Framework-based Fuzzer
Effectiveness = SOAR Partial
Manual Static Analysis - Source Code
CWE Version 4.14
CWE-134: Use of Externally-Controlled Format String
CWE-134: Use of Externally-Controlled Format String