367
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Manual Source Code Review (not inspections) Cost effective for partial coverage: Focused
Manual Spotcheck - Focused manual analysis of source
Effectiveness = High
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer Cost
effective for partial coverage: Warning Flags
Effectiveness = High
Architecture or Design Review
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE
1028 standard) (can apply to requirements, design, source code, etc.)
Effectiveness = High
Potential Mitigations
Phase: Requirements
Choose a language that is not subject to this flaw.
Phase: Implementation
Ensure that all format string functions are passed a static string which cannot be controlled by
the user, and that the proper number of arguments are always sent to that function as well. If
at all possible, use functions that do not support the %n operator in format strings. [REF-116]
[REF-117]
Phase: Build and Compilation
Run compilers and linkers with high warning levels, since they may detect incorrect usage.
Demonstrative Examples
Example 1:
The following program prints a string provided as an argument.
Example Language: C (Bad)
#include <stdio.h>
void printWrapper(char *string) {
printf(string);
}
int main(int argc, char **argv) {
char buf[5012];
memcpy(buf, argv[1], 5012);
printWrapper(argv[1]);
return (0);
}
The example is exploitable, because of the call to printf() in the printWrapper() function. Note: The
stack buffer was added to make exploitation more simple.
Example 2:
The following code copies a command line argument into a buffer using snprintf().
Example Language: C (Bad)
int main(int argc, char **argv){
char buf[128];
...
CWE Version 4.14
CWE-134: Use of Externally-Controlled Format String
CWE-134: Use of Externally-Controlled Format String