3 ms·
Anyone remember printf exploits? Feels strange to still be happening in 2021. I remember accidentally finding a printf exploit in an online Nintendo DS game w
by skim_milk 5y ago
Anyone remember printf exploits? Feels strange to still be happening in 2021. I remember accidentally finding a printf exploit in an online Nintendo DS game when I was a kid, not that I knew what I was doing but it was fun to have my name be a bunch of constantly changing random numbers using %e in my online name. Sounds like the minecraft kids are having a bunch of fun with this one now :)
- nvarsj 5y agoYeah! sudo had a pretty good one, anyone could gain root access via it, back in 2012 [1]. I love the irony here though - given how people using Java tend to think its unexploitable compared to C/C++ code. This is arguably way worse than a format string exploit. Even user sanitized data gives you full RCE. And via url headers/strings. This feels like a 1990s web era exploit, it's pretty insane. 1: https://www.sudo.ws/security/advisories/sudo_debug/ https://www.sudo.ws/security/advisories/sudo_debug/