TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
You can start from here: http://www.phreedom.org/solar/locale_sol.txt http://www.guardent.com/docs/FormatString.PDF Hope it helps. Regards, Dimitar Stoyanov ~ Internet Security Systems ~ Phone: +32 2 475 40 17 Fax: +32 2 479 41 67 -----Original Message----- From: every1sBlind [mailto:[EMAIL PROTECTED]] Sent: Wednesday, October 03, 2001 10:00 AM To: [EMAIL PROTECTED] Subject: Format string vulnerability TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ---------------------------------------------------------------------------- Hello everybody ! First, I always used the printf function that way : printf("%s",string); I didn't thought the contrary would work (?). Then, can someone give me a concrete example of that exploit to show me how does It work exactly ? Thank you. >---------------------------------------------------< A secure print function may look like this: printf(string, "%s"); A vulnerable print function may look like this: printf(string); When user-supplied strings encounter a printf function without a specified format argument, the string is printed without special formatting. However, if a user creates a string including format characters and sends it to an insecure printf function, the string can function as a reference to memory that is normally out of bounds. In order to prevent this, printf functions must contain a print argument to securely restrict user-supplied input to specific memory locations.
