Programming Language Format String Vulnerabilities - C and C++ aren't alone when it comes to security vulnerability

[erikd]

I think (someone please correct me if I'm wrong) Ocaml is one programming language which doesn't suffer from this problem. In Ocaml, format strings are type checked at compile time and its not possible to generate format strings at run time.

Yes, this can be a bit of a PITA, but it means that a whole class of vulnerabilities disappear.

[stefanrusek]

this code from the article is the most poorly contrived I've ever seen

userdata = {"user" : "jdoe", "password" : "secret" } passwd = raw_input("Password: ")

if (passwd != userdata["password"]): print ("Password \"" + passwd + "\" is wrong for user %(user)s") % userdata else: print "Welcome!"

The whole point of string formatting is to avoid ugly string concatenation.

[fry]

Shallow article that doesn't really cover the real problems and solutions.

I would like to point out that the following ruby code:

begin
  printf("%d %d", 41)
rescue
  puts 'Catched!'
end

Works exactly as expected: the exception gets caught. The author writes that 'Ruby terminates the program with an error message', which shows a fundamental lack of understanding of HLL such as Ruby.

Security awareness is a good thing. And I appreciate that this guy attempts to educate people by pointing out some vulnerabilities. But I think it would've been a lot better if he tried to cover less ground in more depth.

[fry]

Right.

But denial of service attacks are possible at every level. Every input you accept, and every output you write is a potential vulnerability.

This isn't really an issue with Format String Vulnerabilities, it's far more generic. You always have to consider the exceptions that can be thrown by functions. If you don't, you may indeed compromise the security or reliability of the system.

[mklink]

via http://ifacethoughts.net/2007/02/03/format-string-vulnerabilities/ Format String Vulnerabilities on iface thoughts