Package: ntop
Version: 3.2rc1
Severity: normal
Tags: security
Hello,
There is a missing format string in emitter.c:sendEmitterString(fDescr,
theString):
if(fDescr == NULL)
sendString(theString);
else
fprintf(fDescr, theString);
I don't think it is exploitable (because IMO, this line can't be
called[1]), but I would prefer another pair of eyes to check this. Also
fixing this could avoid future issues[2].
So I recommend to use:
fprintf(fDescr, "%s", theString);
[1] The emitter.c entry points seems to be the dumpNtop* functions, which
are all called with a NULL fDescr, and thus the sendString line is
always used instead of the fprintf line.
[2] initWriteArray calls:
sendEmitterString(fDescr, "%ntopHash =(\n");
which contains a format string.
Kind Regards,
--
Nekral
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
