Uncontrolled format string
Format string attacks are a new class of vulnerabilities discovered around 1999, previously thought harmless. Format string attacks can be used to crash a program or to execute harmful code. The problem stems from the use of unfiltered user input as the format string parameter in certain C functions that perform formatting, such as printf(). A malicious user may use the %s and %x format tokens, among others, to print data from the stack or possibly other locations in memory. One may also write arbitrary data to arbitrary locations using the %n format token, which commands printf() and similar functions to write back the number of bytes formatted to the same argument to printf(), assuming that the corresponding argument exists, and is of type int * .
This is a common vulnerability due to the fact that format bugs were previously thought harmless and resulted in vulnerabilities in many common tools. MITRE's CVE project list roughly 150 vulnerable programs.
Format string bugs most commonly appear when a programmer wishes to print a string containing user supplied data. The programmer may mistakenly write printf(buffer) instead of printf("%s", buffer). The first version interprets buffer as a format string, and parses any formatting instructions it may contain. The second version simply prints a string to the screen, as the programmer intended.
Format bugs arise because C's argument passing conventions are not type-safe. In particular, the varargs mechanism allows functions to accept any number of arguments (e.g. printf) by "popping" as many arguments off the call stack as they wish, trusting the early arguments to indicate how many additional arguments are to be popped, and of what types.
Format bugs were first noted in 1990 in the fuzz testing work done at the University of Wisconsin (see [Miller,Fredriksen,So 1990]). They called these bugs "interaction effects" and noted their presence when testing the C shell (csh). (this is incorrect, it was first mentioned in the c programming language 2nd edition)
See also
References
- Robert C. Seacord: Secure Coding in C and C++. Addison Wesley, September, 2005. ISBN 0-321-33572-4
- Tobias Klein: Buffer Overflows und Format-String-Schwachstellen, Dpunkt Verlag, ISBN 3-89864-192-9.
- Crispin Cowan: Software Security for Open-Source Systems, Published by the IEEE Computer Society, IEEE SECURITY & PRIVACY, JANUARY/FEBRUARY 2003, http://computer.org/security
- Barton Miller,Lars Fredriksen,Bryan So: An Emperical Study of the Reliability of UNIX Utilities, Communications of the ACM, vol. 33, no. 12 (December 1990). Also appears (in German translation) as Fatale Fehlerträchtigkeit: Eine empirische Studie zur Zuverlässigkeit von UNIX-Utilities, iX, March 1991. http://www.cs.wisc.edu/~bart/fuzz/
External links
- The first public format string exploit
- scut / team teso Exploiting Format String Vulnerabilities v1.1 March 24, 2001