Possible format string vulnerability

--===============0798610834914166792==
Content-Type: multipart/alternative; boundary=047d7bdc7a5ca26dc004dbb02331

--047d7bdc7a5ca26dc004dbb02331
Content-Type: text/plain; charset=ISO-8859-1

Hi,

I work in information flow analysis of programs and my analysis gave a
possible warning with respect to format string vulnerability in ayttm.

*

Function "http_connect" populates "debug_buff" through "inputline".
"inputline" is populated through an external "recv" command. "debugf" is
passed directly to printf without a format string.
*

*Code: (in http_connect)*
*
*
*//Populates inputine through recv call*
*ay_recv_line(sockfd,&inputline)*
*
*
*//Moves inputline to debug_buff*
*snprintf(debug_buff, sizeof(debug_buff), <%s\n",inputline); *
*  *
*
*
*//Passes to debug_print a.k.a printf*
*debug_print(debug_buff)*

Our analysis flagged this behavior.

However, we are not sure whether ayttm developers are aware of this
behaviour. This might very well be a false positive. We just wanted to
confirm our analysis.

Any response in this regard will be appreciated.

Thanks

Regards,
Kapil

--047d7bdc7a5ca26dc004dbb02331
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><span style=3D"font-family:arial,sans-serif;font-size:13px=
">Hi,</span><div style=3D"font-family:arial,sans-serif;font-size:13px"><br>=
</div><div style=3D"font-family:arial,sans-serif;font-size:13px">I work in =
information flow analysis of programs and my analysis gave a possible warni=
ng with respect to format string vulnerability in ayttm.=A0</div>

<div style=3D"font-family:arial,sans-serif;font-size:13px"><br></div><div s=
tyle=3D"font-family:arial,sans-serif;font-size:13px"><b id=3D"docs-internal=
-guid-1bec1592-6250-e8a6-7381-c03fa3b1148e" style=3D"color:rgb(0,0,0);font-=
family:&#39;Times New Roman&#39;;font-size:medium;font-weight:normal"><p di=
r=3D"ltr" style=3D"line-height:1.15;margin-top:0pt;margin-bottom:0pt">

<span style=3D"font-family:arial,sans-serif;font-size:13px;line-height:norm=
al;color:rgb(34,34,34)">Function &quot;http_connect&quot; populates &quot;d=
ebug_buff&quot; through &quot;inputline&quot;. &quot;inputline&quot; is pop=
ulated through an external &quot;recv&quot; command. &quot;debugf&quot; is =
passed directly to printf without a format string.</span><br>

</p></b></div><div style=3D"font-family:arial,sans-serif;font-size:13px"><b=
r></div><div style=3D"font-family:arial,sans-serif;font-size:13px"><i>Code:=
 (in http_connect)</i></div><div style=3D"font-family:arial,sans-serif;font=
-size:13px">

<i><br></i></div><div style=3D"font-family:arial,sans-serif;font-size:13px"=
><i>//Populates inputine through recv call</i></div><div style=3D"font-fami=
ly:arial,sans-serif;font-size:13px"><i>ay_recv_line(sockfd,&amp;inputline)<=
/i></div>

<div style=3D"font-family:arial,sans-serif;font-size:13px"><i><br></i></div=
><div style=3D"font-family:arial,sans-serif;font-size:13px"><i>//Moves inpu=
tline to debug_buff</i></div><div style=3D"font-family:arial,sans-serif;fon=
t-size:13px">

<i>snprintf(debug_buff, sizeof(debug_buff), &lt;%s\n&quot;,inputline);=A0</=
i></div><div style=3D"font-family:arial,sans-serif;font-size:13px"><i>=A0=
=A0</i></div><div style=3D"font-family:arial,sans-serif;font-size:13px"><i>=
<br></i></div>

<div style=3D"font-family:arial,sans-serif;font-size:13px"><i>//Passes to d=
ebug_print a.k.a printf</i></div><div style=3D"font-family:arial,sans-serif=
;font-size:13px"><i>debug_print(debug_buff)</i></div><div style=3D"font-fam=
ily:arial,sans-serif;font-size:13px">

<br></div><div style=3D"font-family:arial,sans-serif;font-size:13px">Our an=
alysis flagged this behavior.=A0</div><div style=3D"font-family:arial,sans-=
serif;font-size:13px"><br></div><div style=3D"font-family:arial,sans-serif;=
font-size:13px">

However, we are not sure whether ayttm developers are aware of this behavio=
ur. This might very well be a false positive. We just wanted to confirm our=
 analysis.</div><div style=3D"font-family:arial,sans-serif;font-size:13px">

<br></div><div style=3D"font-family:arial,sans-serif;font-size:13px">Any re=
sponse in this regard will be appreciated.</div><div style=3D"font-family:a=
rial,sans-serif;font-size:13px"><br></div><div style=3D"font-family:arial,s=
ans-serif;font-size:13px">

Thanks</div><div style=3D"font-family:arial,sans-serif;font-size:13px"><br>=
</div><div style=3D"font-family:arial,sans-serif;font-size:13px">Regards,</=
div><div style=3D"font-family:arial,sans-serif;font-size:13px">Kapil</div><=
/div>


--047d7bdc7a5ca26dc004dbb02331--


--===============0798610834914166792==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
Get 100% visibility into your production application - at no cost.
Code-level diagnostics for performance bottlenecks with <2% overhead
Download for free and get started troubleshooting in minutes.
http://p.sf.net/sfu/appdyn_d2d_ap1
--===============0798610834914166792==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Ayttm-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ayttm-users

--===============0798610834914166792==--