Funniest thing on earth

[Dave Aitel <dave () immunitysec com>]

Funniest thing on earth is from this hypermegalink:
https://buildsecurityin.us-cert.gov/portal/article/knowledge/guidelines/format-string.xml#d0e82


   For those of you who are not programmers, in the following article,
   William L. Fithen has a somewhat non-traditional view of format
   string problems.  He's perhaps better known as one of the authors of
   the Windows of Vulnerability paper. A lot of that paper was
   "intuition" and it's little insights like this report that show you
   where that intuition comes from.

For some other background on the overall web page: 
"Build Security In is a project of the Strategic Initiatives Branch of 
the National Cyber Security Division (NCSD) of the Department of 
Homeland Security (DHS)."
DHS motto: Bringing the strategic infosec humor to you through expensive 
government funding!


   Do Not Use the "%n" Format String Specifier

William L. Fithen
Software Engineering Institute

*Abstract*

Careless use of "|%n|" format strings can introduce vulnerability.


   Description

There are many kinds of vulnerability that can be caused by misusing 
format strings. Most of these are covered elsewhere, but this document 
covers one specific kind of format string vulnerability that is entirely 
unique for format strings. Documents in the public are inconsistent in 
coverage of these vulnerabilities.

In C, use of the "|%n|" format specification in |printf()| and 
|sprintf()| type functions can change memory values. Inappropriate 
design/implementation of these formats can lead to a vulnerability 
generated by changes in memory content. Many format vulnerabilities, 
particularly those with specifiers other than "|%n|", lead to 
traditional failures such as segmentation fault. The "|%n|" specifier 
has generated more damaging vulnerabilities. The "|%n|" vulnerabilities 
may have secondary impacts, since they can also be a significant 
consumer of computing and networking resources because large guantities 
of data may have to be transferred to generate the desired pointer value 
for the exploit.

Avoid using the "|%n|" format specifier. Use other means to accomplish 
your purpose.


To quote Tiago: huhuhuhuhu!

-dave