Best of show – abuse of libc

Post by gambiting » Sat, Jan 09, 2021, 3:26 PM UTC

gambiting wrote: post #78

Narishma wrote: post #77

Earlier quoted context omitted.

I'm pretty sure the compilers from Microsoft and Borland supported %n earlier than that. The earliest one I have easy access to that supports it is Microsoft C 4.0 from 1986.

Does anyone know why it was introduced in the first place? I mean.....the return value of printf gives you the exact same information, no? Why give printf the ability to write anything in the first place?

Post by segfaultbuserr » Sat, Jan 09, 2021, 9:30 PM UTC

stevekemp wrote: post #65

segfaultbuserr wrote: post #25

Earlier quoted context omitted.

In the late 90s, looking for "printf(string)" [0] in the code was a great way to discover remote code execution 0days ;-) [0] should be "printf("%s", string)".

Very much so, it took a long time for this to become obvious as a security problem. My memory wuftpd was the first big program to suffer from this class of attacks.