【嵌入式安全扫盲二】Uncontrolled format string

我不是女神ヾ 2022-06-10 09:55 157阅读 0赞

出处：[https://en.wikipedia.org/wiki/Uncontrolled\_format\_string][https_en.wikipedia.org_wiki_Uncontrolled_format_string]

# Uncontrolled format string #

From Wikipedia, the free encyclopedia

(Redirected from [Format string attack][])

**Uncontrolled format string**[\[1\]][1] is a type of [software vulnerability][] discovered around 1989 that can be used in [security exploits][]. Previously thought harmless, **format string exploits** can be used to [crash][] a program or to execute harmful code. The problem stems from the use of [unchecked user input][] as the [format string][] parameter in certain [C][] functions that perform formatting, such as`printf()`. A malicious user may use the `%s` and `%x` format tokens, among others, to print data from the [call stack][] or possibly other locations in memory. One may also write arbitrary data to arbitrary locations using the `%n` format token, which commands `printf()` and similar functions to write the number of bytes formatted to an address stored on the stack.

## Contents ##

\[hide\]

*  [1Details][]
 *  [2Prevention][]
 *  [3See also][]
 *  [4References][]
 *  [5Footnotes][]
 *  [6External links][]

## Details\[[edit][]\] ##

A typical exploit uses a combination of these techniques to force a program to overwrite the address of a library function or the return address on the stack with a pointer to some malicious[shellcode][]. The padding parameters to format specifiers are used to control the number of bytes output and the `%x` token is used to pop bytes from the stack until the beginning of the format string itself is reached. The start of the format string is crafted to contain the address that the `%n` format token can then overwrite with the address of the malicious code to execute.

This is a common vulnerability because format bugs were previously thought harmless and resulted in vulnerabilities in many common tools. [MITRE's][MITRE_s] CVE project lists roughly 500 vulnerable programs as of June 2007, and a trend analysis ranks it the 9th most-reported vulnerability type between 2001 and 2006.[\[2\]][2]

Format string bugs most commonly appear when a programmer wishes to print a string containing user supplied data. The programmer may mistakenly write `printf(buffer)` instead of `printf("%s", buffer)`. The first version interprets `buffer` as a format string, and parses any formatting instructions it may contain. The second version simply prints a string to the screen, as the programmer intended.

Format bugs arise because C's argument passing conventions are not [type-safe][]. In particular, the `varargs` mechanism allows [functions][] to accept any number of arguments (e.g. `printf`) by "popping" as many [arguments][] off the [call stack][] as they wish, trusting the early arguments to indicate how many additional arguments are to be popped, and of what types.

Format string bugs can occur in other programming languages besides C, although they appear with less frequency and usually cannot be exploited to execute code of the attacker's choice.[\[3\]][3]

Format bugs were first noted in 1989 by the [fuzz testing][] work done at the University of Wisconsin, which discovered an "interaction effect" in the [C shell][] (csh) between its [command history][]mechanism and an error routine that assumed safe string input.[\[4\]][4]

The use of format string bugs as an [attack vector][] was discovered by Tymm Twillman during a [security audit][] of the [ProFTPD][] daemon. The audit uncovered an `snprintf` that directly passed user-generated data without a format string. Extensive tests with contrived arguments to printf-style functions showed that use of this for privilege escalation was actually possible. This led to the first posting in September 1999 on the [Bugtraq][] mailing list regarding this class of vulnerabilities, including a basic exploit.[\[5\]][5] It was still several months, however, before the security community became aware of the full dangers of format string vulnerabilities as exploits for other software using this method began to surface. The first exploits leading to successful [privilege escalation][] attack were published simultaneously on the [Bugtraq][] list in June 2000 by [Przemysław Frasunek][Przemys_aw Frasunek][\[6\]][6] and the person using nickname *tf8*.[\[7\]][7] The seminal paper "Format String Attacks"[\[8\]][8] by[Tim Newsham][] was published in September 2000.

## Prevention\[[edit][edit 1]\] ##

Many compilers can statically check format strings and produce warnings for dangerous or suspect formats.

In [the GNU Compiler Collection][], the relevant compiler flags are, `-Wall`,`-Wformat`, `-Wno-format-extra-args`, `-Wformat-security`, `-Wformat-nonliteral`, and `-Wformat=2`.[\[9\]][9]

Most of these are only useful for detecting bad format strings that are known at compile-time. If the format string may come from the user or from a source external to the application, the application must validate the format string before using it. Care must also be taken if the application generates or selects format strings on the fly. The `-Wformat-nonliteral` check is more stringent.

## See also\[[edit][edit 2]\] ##

*  [Cross-application scripting][] exploits a similar kind of programming error
 *  `printf`
 *  `scanf`
 *  [syslog][]
 *  [Improper input validation][]
 *  [SQL injection][] is a similar attack that succeeds when input is not filtered

## References\[[edit][edit 3]\] ##

*  [Robert C. Seacord][], *Secure Coding in C and C++*. Addison Wesley, September, 2005. [ISBN][] [0-321-33572-4][]
 *  [Tobias Klein][], *Buffer Overflows und Format-String-Schwachstellen*. Dpunkt Verlag, [ISBN][] [3-89864-192-9][].
 *  [Crispin Cowan][], *Software Security for Open-Source Systems*. IEEE Computer Society, [IEEE Security & Privacy][IEEE Security _ Privacy], January/February 2003
 *  Cowan, Crispin (August 2001). [*FormatGuard: Automatic Protection From printf Format String Vulnerabilities*][FormatGuard_ Automatic Protection From printf Format String Vulnerabilities] (PDF). Proceedings of the 10th USENIX Security Symposium.

## Footnotes\[[edit][edit 4]\] ##

1.  **[Jump up^][Jump up]** ["CWE-134: Uncontrolled Format String"][CWE-134_ Uncontrolled Format String]. *[Common Weakness Enumeration][]*. [MITRE][]. December 13, 2010. Retrieved March 5, 2011.
2.  **[Jump up^][Jump up 1]** ["Vulnerability Type Distributions in CVE"][Vulnerability Type Distributions in CVE]. May 22, 2007.
3.  **[Jump up^][Jump up 2]** [Bugtraq: Format String Vulnerabilities in Perl Programs][Bugtraq_ Format String Vulnerabilities in Perl Programs]
4.  **[Jump up^][Jump up 3]** Miller, Barton P.; Fredriksen, Lars; So, Bryan (December 1990). ["An Empirical Study of the Reliability of UNIX Utilities"][An Empirical Study of the Reliability of UNIX Utilities] (PDF). *[Communications of the ACM][]*. **33** (12): 32–44.[doi][]:[10.1145/96267.96279][10.1145_96267.96279].
5.  **[Jump up^][Jump up 4]** [Bugtraq: Exploit for proftpd 1.2.0pre6][Bugtraq_ Exploit for proftpd 1.2.0pre6]
6.  **[Jump up^][Jump up 5]** ['WUFTPD 2.6.0 remote root exploit' - MARC][WUFTPD 2.6.0 remote root exploit_ - MARC]
7.  **[Jump up^][Jump up 6]** ['WuFTPD: Providing \*remote\* root since at least1994' - MARC][WuFTPD_ Providing _remote_ root since at least1994_ - MARC]
8.  **[Jump up^][Jump up 7]** [Bugtraq: Format String Attacks][Bugtraq_ Format String Attacks]
9.  **[Jump up^][Jump up 8]** [Warning Options - Using the GNU Compiler Collection (GCC)][Warning Options - Using the GNU Compiler Collection _GCC]

## External links\[[edit][edit 5]\] ##

*  scut / team-[TESO][] [Exploiting Format String Vulnerabilities][] v1.2 September 9, 2001
 *  [WASC Threat Classification - Format String Attacks][]
 *  [CERT Secure Coding Standards][]
 *  [CERT Secure Coding Initiative][]
 *  [Known vulnerabilities][] at MITRE's CVE project.
 *  [Secure Programming with GCC and GLibc][] (2008), by Marcel Holtmann

[https_en.wikipedia.org_wiki_Uncontrolled_format_string]: https://en.wikipedia.org/wiki/Uncontrolled_format_string
[Format string attack]: https://en.wikipedia.org/w/index.php?title=Format_string_attack&redirect=no
[1]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#cite_note-1
[software vulnerability]: https://en.wikipedia.org/wiki/Software_vulnerability
[security exploits]: https://en.wikipedia.org/wiki/Security_exploit
[crash]: https://en.wikipedia.org/wiki/Crash_%28computing%29
[unchecked user input]: https://en.wikipedia.org/wiki/Unchecked_user_input
[format string]: https://en.wikipedia.org/wiki/Format_string
[C]: https://en.wikipedia.org/wiki/C_%28programming_language%29
[call stack]: https://en.wikipedia.org/wiki/Call_stack
[1Details]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#Details
[2Prevention]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#Prevention
[3See also]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#See_also
[4References]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#References
[5Footnotes]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#Footnotes
[6External links]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#External_links
[edit]: https://en.wikipedia.org/w/index.php?title=Uncontrolled_format_string&action=edit&section=1
[shellcode]: https://en.wikipedia.org/wiki/Shellcode
[MITRE_s]: https://en.wikipedia.org/wiki/Mitre_Corporation
[2]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#cite_note-2
[type-safe]: https://en.wikipedia.org/wiki/Type_safety
[functions]: https://en.wikipedia.org/wiki/Subprogram
[arguments]: https://en.wikipedia.org/wiki/Argument
[3]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#cite_note-3
[fuzz testing]: https://en.wikipedia.org/wiki/Fuzz_testing
[C shell]: https://en.wikipedia.org/wiki/C_shell
[command history]: https://en.wikipedia.org/wiki/Command_history
[4]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#cite_note-4
[attack vector]: https://en.wikipedia.org/wiki/Vector_%28malware%29
[security audit]: https://en.wikipedia.org/wiki/Security_audit
[ProFTPD]: https://en.wikipedia.org/wiki/ProFTPD
[Bugtraq]: https://en.wikipedia.org/wiki/Bugtraq
[5]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#cite_note-5
[privilege escalation]: https://en.wikipedia.org/wiki/Privilege_escalation
[Przemys_aw Frasunek]: https://en.wikipedia.org/wiki/Przemys%C5%82aw_Frasunek
[6]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#cite_note-6
[7]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#cite_note-7
[8]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#cite_note-8
[Tim Newsham]: https://en.wikipedia.org/wiki/Tim_Newsham
[edit 1]: https://en.wikipedia.org/w/index.php?title=Uncontrolled_format_string&action=edit&section=2
[the GNU Compiler Collection]: https://en.wikipedia.org/wiki/GNU_Compiler_Collection
[9]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#cite_note-9
[edit 2]: https://en.wikipedia.org/w/index.php?title=Uncontrolled_format_string&action=edit&section=3
[Cross-application scripting]: https://en.wikipedia.org/wiki/Cross-application_scripting
[syslog]: https://en.wikipedia.org/wiki/Syslog
[Improper input validation]: https://en.wikipedia.org/wiki/Improper_input_validation
[SQL injection]: https://en.wikipedia.org/wiki/SQL_injection
[edit 3]: https://en.wikipedia.org/w/index.php?title=Uncontrolled_format_string&action=edit&section=4
[Robert C. Seacord]: https://en.wikipedia.org/wiki/Robert_C._Seacord
[ISBN]: https://en.wikipedia.org/wiki/International_Standard_Book_Number
[0-321-33572-4]: https://en.wikipedia.org/wiki/Special:BookSources/0-321-33572-4
[Tobias Klein]: https://en.wikipedia.org/w/index.php?title=Tobias_Klein&action=edit&redlink=1
[3-89864-192-9]: https://en.wikipedia.org/wiki/Special:BookSources/3-89864-192-9
[Crispin Cowan]: https://en.wikipedia.org/w/index.php?title=Crispin_Cowan&action=edit&redlink=1
[IEEE Security _ Privacy]: http://www.computer.org/web/computingnow/securityandprivacy
[FormatGuard_ Automatic Protection From printf Format String Vulnerabilities]: http://www.usenix.com/events/sec01/full_papers/cowanbarringer/cowanbarringer.pdf
[edit 4]: https://en.wikipedia.org/w/index.php?title=Uncontrolled_format_string&action=edit&section=5
[Jump up]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#cite_ref-1
[CWE-134_ Uncontrolled Format String]: http://cwe.mitre.org/data/definitions/134.html
[Common Weakness Enumeration]: https://en.wikipedia.org/wiki/Common_Weakness_Enumeration
[MITRE]: https://en.wikipedia.org/wiki/MITRE
[Jump up 1]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#cite_ref-2
[Vulnerability Type Distributions in CVE]: http://cwe.mitre.org/documents/vuln-trends/index.html
[Jump up 2]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#cite_ref-3
[Bugtraq_ Format String Vulnerabilities in Perl Programs]: http://seclists.org/bugtraq/2005/Dec/0030.html
[Jump up 3]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#cite_ref-4
[An Empirical Study of the Reliability of UNIX Utilities]: ftp://ftp.cs.wisc.edu/paradyn/technical_papers/fuzz.pdf
[Communications of the ACM]: https://en.wikipedia.org/wiki/Communications_of_the_ACM
[doi]: https://en.wikipedia.org/wiki/Digital_object_identifier
[10.1145_96267.96279]: https://doi.org/10.1145%2F96267.96279
[Jump up 4]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#cite_ref-5
[Bugtraq_ Exploit for proftpd 1.2.0pre6]: http://seclists.org/bugtraq/1999/Sep/0328.html
[Jump up 5]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#cite_ref-6
[WUFTPD 2.6.0 remote root exploit_ - MARC]: http://marc.theaimsgroup.com/?l=bugtraq&m=96179429114160&w=2
[Jump up 6]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#cite_ref-7
[WuFTPD_ Providing _remote_ root since at least1994_ - MARC]: http://marc.theaimsgroup.com/?l=bugtraq&m=96171893218000&w=2
[Jump up 7]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#cite_ref-8
[Bugtraq_ Format String Attacks]: http://seclists.org/bugtraq/2000/Sep/0214.html
[Jump up 8]: https://en.wikipedia.org/wiki/Uncontrolled_format_string#cite_ref-9
[Warning Options - Using the GNU Compiler Collection _GCC]: https://gcc.gnu.org/onlinedocs/gcc-4.1.2/gcc/Warning-Options.html#Warning-Options
[edit 5]: https://en.wikipedia.org/w/index.php?title=Uncontrolled_format_string&action=edit&section=6
[TESO]: https://en.wikipedia.org/wiki/TESO_%28Austrian_hacker_group%29
[Exploiting Format String Vulnerabilities]: http://julianor.tripod.com/bc/formatstring-1.2.pdf
[WASC Threat Classification - Format String Attacks]: http://projects.webappsec.org/Format-String
[CERT Secure Coding Standards]: https://www.securecoding.cert.org/
[CERT Secure Coding Initiative]: http://www.cert.org/secure-coding
[Known vulnerabilities]: http://www.cve.mitre.org/cgi-bin/cvekey.cgi?keyword=format+string
[Secure Programming with GCC and GLibc]: https://cansecwest.com/csw08/csw08-holtmann.pdf