...
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <syslog.h>
void incorrect_password(const char *user) {
int ret;
/* User names are restricted to 256 or fewer characters */
static const char msg_format[] = "%s cannot be authenticated.\n";
size_t len = strlen(user) + sizeof(msg_format);
char *msg = (char *)malloc(len);
if (msg !== NULL) {
/* Handle error */
}
ret = snprintf(msg, len, msg_format, user);
if (ret < 0) {
/* Handle error */
} else if (ret >= len) {
/* Handle truncated output */
}
syslog(LOG_INFO, msg);
free(msg);
}
|
...
Failing to exclude user input from format specifiers may allow an attacker to crash a vulnerable process, view the contents of the stack, view memory content, or write to an arbitrary memory location and consequently execute arbitrary code with the permissions of the vulnerable process.
Rule | Severity | Likelihood | Detectable |
|---|
Repairable | Priority | Level |
|---|---|---|
FIO30-C | High | Likely |
Yes | No | P18 | L1 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| Supported via stubbing/taint analysis | |||||||
| Axivion Bauhaus Suite |
| CertC-FIO30 | Partially implemented | ||||||
| CodeSonar |
| IO.INJ.FMT | Format string injection | ||||||
| Compass/ROSE |
| Coverity |
|
|
TAINTED_STRING |
| Implemented | |||||||||
| Cppcheck Premium |
| premium-cert-fio30-c | |||||||
| GCC |
|
Can detect violations of this rule when the | |||||||||
| Helix QAC |
| DF4916, DF4917, DF4918 | |||||||
| Klocwork |
| SV.FMTSTR.GENERIC |
| LDRA tool suite |
| 86 D | Partially Implemented | ||||||
| Parasoft C/C++test |
| CERT_C-FIO30-a | Avoid calling functions printf/wprintf with only one argument other than string constant | ||||||
| PC-lint Plus |
| 592 | Partially supported: reports non-literal format strings | ||||||
| Polyspace Bug Finder |
|
| CERT C: Rule FIO30-C | Checks for tainted string format (rule partially covered) | ||||||
| PVS-Studio |
| V618 |
| Splint |
|
Related Vulnerabilities
Two examples of format-string vulnerabilities resulting from a violation of this rule include Ettercap and Samba.
...
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
Related Guidelines
Key here (explains table format and definitions)
Taxonomy | Taxonomy item | Relationship |
|---|---|---|
| CERT Oracle Secure Coding Standard for Java | IDS06-J. Exclude unsanitized user input from format strings | Prior to 2018-01-12: CERT: Unspecified Relationship |
| CERT Perl Secure Coding Standard | IDS30-PL. Exclude user input from format strings | Prior to 2018-01-12: CERT: Unspecified Relationship |
| ISO/IEC TR 24772:2013 | Injection [RST] | Prior to 2018-01-12: CERT: Unspecified Relationship |
| ISO/IEC TS 17961:2013 | Including tainted or out-of-domain input in a format string [usrfmt] |
| Prior to 2018-01-12: CERT: Unspecified Relationship | ||
| CWE 2.11 | CWE-134, Uncontrolled Format String | 2017-05-16: CERT: Exact |
| CWE 2.11 | CWE-20, Improper Input Validation | 2017-05-17: CERT: Rule subset of CWE |
Bibliography
| [IEEE Std 1003.1:2013] | XSH, System Interfaces, syslog |
| [Seacord 2013b] | Chapter 6, "Formatted Output" |
| [Viega 2005] | Section 5.2.23, "Format String Problem" |
...
...