369
Nature Type ID Name Page
MemberOf 635 Weaknesses Originally Used by NVD from 2008 to 2016 635 2552
MemberOf 726 OWASP Top Ten 2004 Category A5 - Buffer Overflows 711 2336
MemberOf 743 CERT C Secure Coding Standard (2008) Chapter 10 -
Input Output (FIO)
734 2347
MemberOf 808 2010 Top 25 - Weaknesses On the Cusp 800 2355
MemberOf 845 The CERT Oracle Secure Coding Standard for
Java (2011) Chapter 2 - Input Validation and Data
Sanitization (IDS)
844 2362
MemberOf 865 2011 Top 25 - Risky Resource Management 900 2371
MemberOf 877 CERT C++ Secure Coding Section 09 - Input Output
(FIO)
868 2377
MemberOf 884 CWE Cross-section 884 2567
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1131 CISQ Quality Measures (2016) - Security 1128 2442
MemberOf 1134 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 00. Input Validation and Data Sanitization
(IDS)
1133 2444
MemberOf 1163 SEI CERT C Coding Standard - Guidelines 09. Input
Output (FIO)
1154 2459
MemberOf 1179 SEI CERT Perl Coding Standard - Guidelines 01. Input
Validation and Data Sanitization (IDS)
1178 2465
MemberOf 1308 CISQ Quality Measures - Security 1305 2485
MemberOf 1340 CISQ Data Protection Measures 1340 2590
MemberOf 1399 Comprehensive Categorization: Memory Safety 1400 2525
Notes
Applicable Platform
This weakness is possible in any programming language that support format strings.
Other
While Format String vulnerabilities typically fall under the Buffer Overflow category, technically
they are not overflowed buffers. The Format String vulnerability is fairly new (circa 1999) and
stems from the fact that there is no realistic way for a function that takes a variable number of
arguments to determine just how many arguments were passed in. The most common functions
that take a variable number of arguments, including C-runtime functions, are the printf() family of
calls. The Format String problem appears in a number of ways. A *printf() call without a format
specifier is dangerous and can be exploited. For example, printf(input); is exploitable, while
printf(y, input); is not exploitable in that context. The result of the first call, used incorrectly,
allows for an attacker to be able to peek at stack memory since the input string will be used
as the format specifier. The attacker can stuff the input string with format specifiers and begin
reading stack values, since the remaining parameters will be pulled from the stack. Worst case,
this improper use may give away enough control to allow an arbitrary value (or values in the
case of an exploit program) to be written into the memory of the running program. Frequently
targeted entities are file names, process names, identifiers. Format string problems are a classic
C/C++ issue that are now rare due to the ease of discovery. One main reason format string
vulnerabilities can be exploited is due to the %n operator. The %n operator will write the number
of characters, which have been printed by the format string therefore far, to the memory pointed
to by its argument. Through skilled creation of a format string, a malicious user may use values
on the stack to create a write-what-where condition. Once this is achieved, they can execute
arbitrary code. Other operators can be used as well; for example, a %9999s operator could also
trigger a buffer overflow, or when used in file-formatting functions like fprintf, it can generate a
much larger output than intended.
CWE Version 4.14
CWE-135: Incorrect Calculation of Multi-Byte String Length
CWE-135: Incorrect Calculation of Multi-Byte String Length