Possible format string vulnerability

--===============5651204572107819719==
Content-Type: multipart/alternative; boundary=089e014954c8918969051dec2e79

--089e014954c8918969051dec2e79
Content-Type: text/plain; charset=UTF-8

Hi,

I work in information flow analysis of programs and my analysis gave a
possible warning with respect to format string vulnerability in ayttm. I
had pointed out this behaviour earlier, so wanted to check whether code
base has been modified to fix this vulnerability.

Function "http_connect" populates "debug_buff" through "inputline".
"inputline" is populated through an external "recv" command. "debugf" is
passed directly to printf without a format string.

*Code: (in http_connect)*

*//Populates inputine through recv call*
*ay_recv_line(sockfd,&inputline)*

*//Moves inputline to debug_buff*
*snprintf(debug_buff, sizeof(debug_buff), <%s\n",inputline); *


*//Passes to debug_print a.k.a printf*
*debug_print(debug_buff)*

Our analysis flagged this behavior.

However, we are not sure whether ayttm developers are aware of this
behaviour. This might very well be a false positive. We just wanted to
confirm our analysis.

Any response in this regard will be appreciated.

Thanks

Regards,
Kapil

--089e014954c8918969051dec2e79
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><span style=3D"font-size:13px">Hi,</span><div style=3D"fon=
t-size:13px"><br></div><div style=3D"font-size:13px">I work in information =
flow analysis of programs and my analysis gave a possible warning with resp=
ect to format string vulnerability in=C2=A0<span class=3D"">ayttm</span>. I=
 had pointed out this behaviour earlier, so wanted to check whether code ba=
se has been modified to fix this vulnerability.</div><div style=3D"font-siz=
e:13px"><br></div><div style=3D"font-size:13px"><span style=3D"color:rgb(0,=
0,0);font-family:&#39;Times New Roman&#39;;font-size:medium"><p dir=3D"ltr"=
 style=3D"line-height:1.15;margin-top:0pt;margin-bottom:0pt"><span style=3D=
"font-family:arial,sans-serif;font-size:13px;line-height:normal;color:rgb(3=
4,34,34)">Function &quot;http_connect&quot; populates &quot;debug_buff&quot=
; through &quot;inputline&quot;. &quot;inputline&quot; is populated through=
 an external &quot;recv&quot; command. &quot;debugf&quot; is passed directl=
y to printf without a format string.</span><br></p></span></div><div style=
=3D"font-size:13px"><br></div><div style=3D"font-size:13px"><i>Code: (in ht=
tp_connect)</i></div><div style=3D"font-size:13px"><i><br></i></div><div st=
yle=3D"font-size:13px"><i>//Populates inputine through recv call</i></div><=
div style=3D"font-size:13px"><i>ay_recv_line(sockfd,&amp;inputline)</i></di=
v><div style=3D"font-size:13px"><i><br></i></div><div style=3D"font-size:13=
px"><i>//Moves inputline to debug_buff</i></div><div style=3D"font-size:13p=
x"><i>snprintf(debug_buff, sizeof(debug_buff), &lt;%s\n&quot;,inputline);=
=C2=A0</i></div><div style=3D"font-size:13px"><i>=C2=A0=C2=A0</i></div><div=
 style=3D"font-size:13px"><i><br></i></div><div style=3D"font-size:13px"><i=
>//Passes to debug_print a.k.a printf</i></div><div style=3D"font-size:13px=
"><i>debug_print(debug_buff)</i></div><div style=3D"font-size:13px"><br></d=
iv><div style=3D"font-size:13px">Our analysis flagged this behavior.=C2=A0<=
/div><div style=3D"font-size:13px"><br></div><div style=3D"font-size:13px">=
However, we are not sure whether=C2=A0<span class=3D"">ayttm</span>=C2=A0de=
velopers are aware of this behaviour. This might very well be a false posit=
ive. We just wanted to confirm our analysis.</div><div style=3D"font-size:1=
3px"><br></div><div style=3D"font-size:13px">Any response in this regard wi=
ll be appreciated.</div><div style=3D"font-size:13px"><br></div><div style=
=3D"font-size:13px">Thanks</div><div style=3D"font-size:13px"><br></div><di=
v style=3D"font-size:13px">Regards,</div><div style=3D"font-size:13px">Kapi=
l</div></div>

--089e014954c8918969051dec2e79--


--===============5651204572107819719==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------

--===============5651204572107819719==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Ayttm-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ayttm-users

--===============5651204572107819719==--