Re: Possible format string vulnerability

--===============4932623826502008356==
Content-Type: multipart/alternative; boundary=047d7b5d3fea0c5011051dec8a72

--047d7b5d3fea0c5011051dec8a72
Content-Type: text/plain; charset=UTF-8

Considering the last commit was dated 2011-12-15 03:07:28, I doubt anything
will be changed.

It would be cool if somebody were to pick this back up, but I don't see it
happening.

On Sat, Aug 22, 2015 at 4:24 PM, Kapil Anand <[email protected]> wrote:

> Hi,
>
> I work in information flow analysis of programs and my analysis gave a
> possible warning with respect to format string vulnerability in ayttm. I
> had pointed out this behaviour earlier, so wanted to check whether code
> base has been modified to fix this vulnerability.
>
> Function "http_connect" populates "debug_buff" through "inputline".
> "inputline" is populated through an external "recv" command. "debugf" is
> passed directly to printf without a format string.
>
> *Code: (in http_connect)*
>
> *//Populates inputine through recv call*
> *ay_recv_line(sockfd,&inputline)*
>
> *//Moves inputline to debug_buff*
> *snprintf(debug_buff, sizeof(debug_buff), <%s\n",inputline); *
>
>
> *//Passes to debug_print a.k.a printf*
> *debug_print(debug_buff)*
>
> Our analysis flagged this behavior.
>
> However, we are not sure whether ayttm developers are aware of this
> behaviour. This might very well be a false positive. We just wanted to
> confirm our analysis.
>
> Any response in this regard will be appreciated.
>
> Thanks
>
> Regards,
> Kapil
>
>
> ------------------------------------------------------------------------------
>
> _______________________________________________
> Ayttm-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/ayttm-users
>
>

--047d7b5d3fea0c5011051dec8a72
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Considering the last commit was dated=C2=A02011-12-15 03:0=
7:28, I doubt anything will be changed.<br><br>It would be cool if somebody=
 were to pick this back up, but I don&#39;t see it happening.</div><div cla=
ss=3D"gmail_extra"><br><div class=3D"gmail_quote">On Sat, Aug 22, 2015 at 4=
:24 PM, Kapil Anand <span dir=3D"ltr">&lt;<a href=3D"mailto:kapilanand2@gma=
il.com" target=3D"_blank">[email protected]</a>&gt;</span> wrote:<br><b=
lockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px =
#ccc solid;padding-left:1ex"><div dir=3D"ltr"><span style=3D"font-size:13px=
">Hi,</span><div style=3D"font-size:13px"><br></div><div style=3D"font-size=
:13px">I work in information flow analysis of programs and my analysis gave=
 a possible warning with respect to format string vulnerability in=C2=A0<sp=
an>ayttm</span>. I had pointed out this behaviour earlier, so wanted to che=
ck whether code base has been modified to fix this vulnerability.</div><div=
 style=3D"font-size:13px"><br></div><div style=3D"font-size:13px"><span sty=
le=3D"color:rgb(0,0,0);font-family:&#39;Times New Roman&#39;;font-size:medi=
um"><p dir=3D"ltr" style=3D"line-height:1.15;margin-top:0pt;margin-bottom:0=
pt"><span style=3D"font-family:arial,sans-serif;font-size:13px;line-height:=
normal;color:rgb(34,34,34)">Function &quot;http_connect&quot; populates &qu=
ot;debug_buff&quot; through &quot;inputline&quot;. &quot;inputline&quot; is=
 populated through an external &quot;recv&quot; command. &quot;debugf&quot;=
 is passed directly to printf without a format string.</span><br></p></span=
></div><div style=3D"font-size:13px"><br></div><div style=3D"font-size:13px=
"><i>Code: (in http_connect)</i></div><div style=3D"font-size:13px"><i><br>=
</i></div><div style=3D"font-size:13px"><i>//Populates inputine through rec=
v call</i></div><div style=3D"font-size:13px"><i>ay_recv_line(sockfd,&amp;i=
nputline)</i></div><div style=3D"font-size:13px"><i><br></i></div><div styl=
e=3D"font-size:13px"><i>//Moves inputline to debug_buff</i></div><div style=
=3D"font-size:13px"><i>snprintf(debug_buff, sizeof(debug_buff), &lt;%s\n&qu=
ot;,inputline);=C2=A0</i></div><div style=3D"font-size:13px"><i>=C2=A0=C2=
=A0</i></div><div style=3D"font-size:13px"><i><br></i></div><div style=3D"f=
ont-size:13px"><i>//Passes to debug_print a.k.a printf</i></div><div style=
=3D"font-size:13px"><i>debug_print(debug_buff)</i></div><div style=3D"font-=
size:13px"><br></div><div style=3D"font-size:13px">Our analysis flagged thi=
s behavior.=C2=A0</div><div style=3D"font-size:13px"><br></div><div style=
=3D"font-size:13px">However, we are not sure whether=C2=A0<span>ayttm</span=
>=C2=A0developers are aware of this behaviour. This might very well be a fa=
lse positive. We just wanted to confirm our analysis.</div><div style=3D"fo=
nt-size:13px"><br></div><div style=3D"font-size:13px">Any response in this =
regard will be appreciated.</div><div style=3D"font-size:13px"><br></div><d=
iv style=3D"font-size:13px">Thanks</div><div style=3D"font-size:13px"><br><=
/div><div style=3D"font-size:13px">Regards,</div><div style=3D"font-size:13=
px">Kapil</div></div>
<br>-----------------------------------------------------------------------=
-------<br>
<br>_______________________________________________<br>
Ayttm-users mailing list<br>
<a href=3D"mailto:[email protected]">[email protected]=
ceforge.net</a><br>
<a href=3D"https://lists.sourceforge.net/lists/listinfo/ayttm-users" rel=3D=
"noreferrer" target=3D"_blank">https://lists.sourceforge.net/lists/listinfo=
/ayttm-users</a><br>
<br></blockquote></div><br></div>

--047d7b5d3fea0c5011051dec8a72--


--===============4932623826502008356==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------

--===============4932623826502008356==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Ayttm-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ayttm-users

--===============4932623826502008356==--