Content deleted Content added
The exploits mentioned were not the first privilege escalation issues; they were the first remote root exploits that obtained code execution and then a root shell. Furthermore added some details about detecting format strings in binaries. (Full disclosure: I was the author of a presentation back then that described scanning binaries for format string bugs; it is referenced from the TESO article, but I felt I should not add a reference to the main page due to conflict-of-interest). |
|||
Line 25:
== Detection in x86-compiled binaries ==
Contrary to many other security issues, the root cause of format string vulnerabilities is relatively
the number of arguments passed to the function; an 'argument deficiency'<ref name="team_teso"/> is then a strong indicator that the function was misused. Counting the number of arguments is often made easy on x86 due to a calling convention where the caller removes the arguments that were pushed onto the stack by adding to the stack pointer after the call, so a simple examination of the stack correction yields the number of arguments passed to the <code>printf</code>-family function.
| |||