Thanks. I have forwarded this upstream.
Regards, // Ola On Thu, Oct 27, 2005 at 11:13:22AM +0200, Nicolas François wrote: > Package: ntop > Version: 3.2rc1 > Severity: normal > Tags: security > > Hello, > > There is a missing format string in emitter.c:sendEmitterString(fDescr, > theString): > > if(fDescr == NULL) > sendString(theString); > else > fprintf(fDescr, theString); > > I don't think it is exploitable (because IMO, this line can't be > called[1]), but I would prefer another pair of eyes to check this. Also > fixing this could avoid future issues[2]. > > So I recommend to use: > fprintf(fDescr, "%s", theString); > > [1] The emitter.c entry points seems to be the dumpNtop* functions, which > are all called with a NULL fDescr, and thus the sendString line is > always used instead of the fprintf line. > > [2] initWriteArray calls: > sendEmitterString(fDescr, "%ntopHash =(\n"); > which contains a format string. > > Kind Regards, > -- > Nekral > > -- --------------------- Ola Lundqvist --------------------------- / [EMAIL PROTECTED] Annebergsslingan 37 \ | [EMAIL PROTECTED] 654 65 KARLSTAD | | +46 (0)54-10 14 30 +46 (0)70-332 1551 | | http://www.opal.dhs.org UIN/icq: 4912500 | \ gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9 / --------------------------------------------------------------- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
