...
| Code Block | ||||
|---|---|---|---|---|
| ||||
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <syslog.h>
void incorrect_password(const char *user) {
int ret;
/* User names are restricted to 256 or fewer characters */
static const char msg_format[] = "%s cannot be authenticated.\n";
size_t len = strlen(user) + sizeof(msg_format);
char *msg = (char *)malloc(len);
if (msg !== NULL) {
/* Handle error */
}
ret = snprintf(msg, len, msg_format, user);
if (ret < 0) {
/* Handle error */
} else if (ret >= len) {
/* Handle truncated output */
}
syslog(LOG_INFO, msg);
free(msg);
}
|
...
Failing to exclude user input from format specifiers may allow an attacker to crash a vulnerable process, view the contents of the stack, view memory content, or write to an arbitrary memory location and consequently execute arbitrary code with the permissions of the vulnerable process.
Rule | Severity | Likelihood | Detectable | RepairableRemediation Cost | Priority | Level |
|---|---|---|---|---|---|---|
FIO30-C | High | Likely | Yes | MediumNo | P18 | L1 |
Automated Detection
Tool | Version | Checker | Description | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Astrée |
| Supported via stubbing/taint analysis | ||||||||||||
| Axivion Bauhaus Suite |
| CertC-FIO30 | Partially implemented | |||||||||||
| CodeSonar |
| IO.INJ.FMT | Format string injection | |||||||||||
| Compass/ROSE | ||||||||||||||
| Coverity |
| TAINTED_STRING | Implemented | |||||||||||
| Cppcheck Premium |
| premium-cert-fio30-c | ||||||||||||
| GCC |
| Can detect violations of this rule when the | ||||||||||||
| Helix QAC |
| DF4916, DF4917, DF4918 | ||||||||||||
| Klocwork |
| SV.FMTSTR.GENERIC | ||||||||||||
| LDRA tool suite |
| 86 D | Partially Implemented | |||||||||||
| Parasoft C/C++test |
| SECURITY-05 SECURITY-08 SECURITY-36CERT_C-FIO30-a | Avoid calling functions printf/wprintf with only one argument other than string constant | |||||||||||
| PC-lint Plus |
| 592 | Partially supported: reports non-literal format strings | |||||||||||
| Polyspace Bug Finder |
| R2016a | Tainted string format | Input format argument is from an unsecure source
| CERT C: Rule FIO30-C | Checks for tainted string format (rule partially covered) | ||||||||
| PVS-Studio |
| V618 | ||||||||||||
| Splint |
|
Related Vulnerabilities
Two examples of format-string vulnerabilities resulting from a violation of this rule include Ettercap and Samba.
...