Format String Vulnerabilities: Explanation, Impact, and Prevention, Slides of Software Engineering

Download Format String Vulnerabilities: Explanation, Impact, and Prevention and more Slides Software Engineering in PDF only on Docsity!

Format String pROBLEMS

Overview

• String Formatting Explained
• Exploiting string format errors
• Examples
• Spotting and correcting the problem

How it affects security

Access Control: Redirect execution to malicious code

Confidentiality: Can expose information about a program that can lead to further exploitation

Integrity: Values can be overwritten in memory

Exploiting string format problems

#include <stdio.h>

int main(int argc, char* argv[]) { If(argc > 1) printf(argv[1]); return 0; }

Sample input: “%x %x” Sample output: 12ffc0 4011e

Source: (Howard, LeBlanc, and Viega 19)

Detecting and spotting the problems

 Luckily the problem is easy to detect and mitigate

 Lexical source code scanners can detect the errors and Crispin Cowan offers FormatGuard a built in compilation tool

 Right: printf(“%s,” user_input); printf(“%d,” user_input);  Wrong: printf(user_input); syslog(LOG_FILE, userText);

Summary

• Do use fixed format strings
• Do NOT pass user intput directly as the format

string functions.

• Do avoid using printf(), scanf() family of

functions if you can.