368
snprintf(buf,128,argv[1]);
}
This code allows an attacker to view the contents of the stack and write to the stack using a
command line argument containing a sequence of formatting directives. The attacker can read
from the stack by providing more formatting directives, such as %x, than the function takes as
arguments to be formatted. (In this example, the function takes no arguments to be formatted.)
By using the %n formatting directive, the attacker can write to the stack, causing snprintf() to write
the number of bytes output thus far to the specified argument (rather than reading a value from
the argument, which is the intended behavior). A sophisticated version of this attack will use four
staggered writes to completely control the value of a pointer on the stack.
Example 3:
Certain implementations make more advanced attacks even easier by providing format directives
that control the location in memory to read from or write to. An example of these directives is shown
in the following code, written for glibc:
Example Language: C (Bad)
printf("%d %d %1$d %1$d\n", 5, 9);
This code produces the following output: 5 9 5 5 It is also possible to use half-writes (%hn) to
accurately control arbitrary DWORDS in memory, which greatly reduces the complexity needed to
execute an attack that would otherwise require four staggered writes, such as the one mentioned in
the first example.
Observed Examples
Reference Description
CVE-2002-1825 format string in Perl program
https://www.cve.org/CVERecord?id=CVE-2002-1825
CVE-2001-0717 format string in bad call to syslog function
https://www.cve.org/CVERecord?id=CVE-2001-0717
CVE-2002-0573 format string in bad call to syslog function
https://www.cve.org/CVERecord?id=CVE-2002-0573
CVE-2002-1788 format strings in NNTP server responses
https://www.cve.org/CVERecord?id=CVE-2002-1788
CVE-2006-2480 Format string vulnerability exploited by triggering errors or warnings, as
demonstrated via format string specifiers in a .bmp filename.
https://www.cve.org/CVERecord?id=CVE-2006-2480
CVE-2007-2027 Chain: untrusted search path enabling resultant format string by loading
malicious internationalization messages
https://www.cve.org/CVERecord?id=CVE-2007-2027
Functional Areas
• Logging
• Error Handling
• String Processing
Affected Resources
• Memory
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-134: Use of Externally-Controlled Format String
CWE-134: Use of Externally-Controlled Format String