4 ms·
By that same logic, puts("Hello, world!"); is also vulnerable to DoS attack and information leak since someone could have removed the NUL terminator at the end
by dezgeg 7y ago
By that same logic, puts("Hello, world!"); is also vulnerable to DoS attack and information leak since someone could have removed the NUL terminator at the end of the string and have puts() read uninitialized/unmapped memory. Which is absurd logic.
- shakna 7y agoFormat string attacks have occurred in the wild. [0] > Originally thought harmless, format string exploits can be used to crash a program or to execute harmful code. They are not the same as puts. Puts can allow you to potentially read memory. A format string attack can allow you to write to memory. [0] https://en.wikipedia.org/wiki/Uncontrolled_format_string https://en.wikipedia.org/wiki/Uncontrolled_format_string
- scatters 7y agoSo an attacker able to write to memory would be able to elevate into the ability to... write to memory. That doesn't sound particularly worrisome.
- nocturnial 7y agoIn a lot of cases the attacker can only write to a limited range of memory addresses. If that string happens to fall in that range, they can use it to write to other addresses and/or find out where in memory certain things are stored. So their ability to write to a limited range of addresses can be extended to a larger range.
- a1369209993 7y agoIf the attacker can write to string memory, they can overwrite "%s\n\0Hello World" just as easily as "Hello World\n".
- cozzyd 7y agoYes if the attacker has control of the string (like if you do printf(getenv("FOO")) or something equally stupid).