Re: Format Bugs in Windows Code?

[Daniel Jacobowitz <dmj+ () ANDREW CMU EDU>]

On Sun, Sep 10, 2000 at 02:00:21AM -0700, Crispin Cowan wrote:
> "Bluefish (P.Magnusson)" wrote:
>
> > > I see no reason why this class of
> > > bugs should be restricted to UNIX code.
> >
> > Depends on how the compiler implements vargs?
>
> Is that actually true?  It seems to me that if the compiler
> implements varargs at all, then it is exploitable.

Actually, depends on how the ABI implements varargs; this isn't
generally up to the compiler.

If, for instance, a separate region of memory apart from the stack was
used (I can't think of any case where this is true, but I can think of
reasons for it to be tried, such as preventing varargs
errors/exploits...), then it would in most cases not be exploitable.

> > Anyone keeping records of when these bugs were first realized & discoved?
>
> I log everything I get.  The first clue I can find of format bugs is this June 23 2000 Bugtraq
> post
> http://www.securityfocus.com/templates/archive.pike?mid=66544&threads=0&end=2000-06-25&start=2000-06-19&list=1&fromthread=0&;
>
> which in turn refers to the wuftpd exploit posted by tf8
> http://www.securityfocus.com/templates/archive.pike?mid=66367&threads=0&end=2000-06-25&start=2000-06-19&list=1&fromthread=0&;
>
> The comments in the code claim to come from October 15, 1999.

The first that I know of was in ProFTPd, actually.  It was fixed before
it was much talked about.  I wrote an exploit around December 19, 1999
- remember crack.linuxppc.org?  It was discussed as a possible security
problem, in the context of logging.

The change was:
revision 1.14
date: 1999/09/16 07:42:14;  author: macgyver;  state: Exp;  lines: +2 -2
Fixed a silly, yet insidious, way to overflow a buffer.

And the message reporting it, about a week before the beginning of any
proftpd-devel archives I can find, did describe more or less how to
cause a format string attack, although this was before %n was much
known about - in fact, I exploited this as an overflow rather than as a
%n peek-poke type attack.  Either would have worked.

Dan

/--------------------------------\  /--------------------------------\
|       Daniel Jacobowitz        |__|        SCS Class of 2002       |
|   Debian GNU/Linux Developer    __    Carnegie Mellon University   |
|         dan () debian org         |  |       dmj+ () andrew cmu edu      |
\--------------------------------/  \--------------------------------/