CWE-134 Detail

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Modes Of Introduction

Implementation : The programmer rarely intends for a format string to be externally-controlled at all. This weakness is frequently introduced in code that constructs log messages, where a constant format string is omitted.
Implementation : In cases such as localization and internationalization, the language-specific message repositories could be an avenue for exploitation, but the format string issue would be resultant, since attacker control of those repositories would also allow modification of message length, format, and content.

Piattaforme applicabili

Linguaggio

Class: Not Language-Specific (Undetermined)
Name: C (Often)
Name: C++ (Often)
Name: Perl (Rarely)

Conseguenze comuni

Esempi osservati

Potential Mitigations

Phases : Requirements
Choose a language that is not subject to this flaw.
Phases : Implementation
Ensure that all format string functions are passed a static string which cannot be controlled by the user, and that the proper number of arguments are always sent to that function as well. If at all possible, use functions that do not support the %n operator in format strings. [REF-116] [REF-117]
Phases : Build and Compilation
Run compilers and linkers with high warning levels, since they may detect incorrect usage.

Detection Methods

Automated Static Analysis

This weakness can often be detected using automated static analysis tools. Many modern tools use data flow analysis or constraint-based techniques to minimize the number of false positives.

Black Box

Since format strings often occur in rarely-occurring erroneous conditions (e.g. for error message logging), they can be difficult to detect using black box methods. It is highly likely that many latent issues exist in executables that do not have associated source code (or equivalent source.
Effectiveness : Limited

Automated Static Analysis - Binary or Bytecode

Effectiveness : High

Manual Static Analysis - Binary or Bytecode

Effectiveness : SOAR Partial

Dynamic Analysis with Automated Results Interpretation

Effectiveness : SOAR Partial

Dynamic Analysis with Manual Results Interpretation

Effectiveness : SOAR Partial

Manual Static Analysis - Source Code

Effectiveness : High

Automated Static Analysis - Source Code

Effectiveness : High

Architecture or Design Review

Effectiveness : High

Note sulla mappatura delle vulnerabilità

Giustificazione : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Commento : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Pattern di attacco correlati

Note

Format string issues are under-studied for languages other than C. Memory or disk consumption, control flow or variable alteration, and data corruption may result from format string exploitation in applications written in other languages such as Perl, PHP, Python, etc.

Riferimenti

REF-116

Format String Vulnerabilities in Perl Programs
Steve Christey.
https://seclists.org/fulldisclosure/2005/Dec/91

REF-117

Programming Language Format String Vulnerabilities
Hal Burch, Robert C. Seacord.
https://drdobbs.com/security/programming-language-format-string-vulne/197002914

REF-118

Format String Attacks
Tim Newsham.
https://seclists.org/bugtraq/2000/Sep/214

REF-7

Writing Secure Code
Michael Howard, David LeBlanc.
https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223

REF-44

24 Deadly Sins of Software Security
Michael Howard, David LeBlanc, John Viega.

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

REF-962

Automated Source Code Security Measure (ASCSM)
Object Management Group (OMG).
http://www.omg.org/spec/ASCSM/1.0/

REF-1479

State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation
Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy.
https://www.ida.org/-/media/feature/publications/s/st/stateoftheart-resources-soar-for-software-vulnerability-detection-test-and-evaluation/p-5061.ashx

Invio

Modifiche