Content deleted Content added
Artoria2e5 (talk | contribs) No edit summary Tags: Mobile edit Mobile web edit Advanced mobile edit |
Add mention of earlier technical publications (disclaimer: I posted the second) |
||
Line 16:
Format bugs were first noted in 1989 by the [[fuzz testing]] work done at the University of Wisconsin, which discovered an "interaction effect" in the [[C shell]] (csh) between its [[command history]] mechanism and an error routine that assumed safe string input.<ref name="Miller_1990"/>
The use of format string bugs as an [[Vector (malware)|attack vector]] was discovered in September 1999 by [[Tymm Twillman]] during a [[security audit]] of the [[ProFTPD]] daemon.<ref name="Tymm_proftpd"/> The audit uncovered an <code>[[snprintf]]</code> that directly passed user-generated data without a format string. Extensive tests with contrived arguments to printf-style functions showed that use of this for privilege escalation was possible. This led to the first posting in September 1999 on the [[Bugtraq]] mailing list regarding this class of vulnerabilities, including a basic exploit.<ref name="Tymm_proftpd"/> It was still several months, however, before the security community became aware of the full dangers of format string vulnerabilities as exploits for other software using this method began to surface. The first exploits that brought the issue to common awareness (by providing remote root access via code execution) were published simultaneously on the [[Bugtraq]] list in June 2000 by [[Przemysław Frasunek]]<ref name="Frasunek_2000"/> and a person using the nickname ''tf8''.<ref name="tf8_2000"/> They were shortly followed by an explanation, posted by a person using the nickname ''lamagra''.<ref name="Lamagra_2000" /> "Format bugs" was posted to the [[Bugtraq]] list by Pascal Bouchareine in July 2000.<ref name="Bouch_2000"/> The seminal paper "Format String Attacks"<ref name="Newsham_2000"/> by [[Tim Newsham]] was published in September 2000 and other detailed technical explanation papers were published in September 2001 such as ''Exploiting Format String Vulnerabilities'', by team [[TESO (Austrian hacker group)|Teso]].<ref name="team_teso"/>
== Prevention in compilers ==
Line 52:
<ref name="Newsham_2000">[http://seclists.org/bugtraq/2000/Sep/0214.html Bugtraq: Format String Attacks][[Tim Newsham]] September 2000</ref>
<ref name="GCC412">[https://gcc.gnu.org/onlinedocs/gcc-4.1.2/gcc/Warning-Options.html#Warning-Options Warning Options - Using the GNU Compiler Collection (GCC)]</ref>
<ref name="Bouch_2000">[https://seclists.org/bugtraq/2000/Jul/241 Bugtraq: Format Bugs] [https://www.lysator.liu.se/~kjell-e/tekla/linux/security/bugtraq/2000/format-bugs-2000-07.html Format bugs] July 2000 by Pascal Bouchareine</ref>
<ref name="Lamagra_2000">[https://seclists.org/bugtraq/2000/Jun/339 Bugtraq: format bugs, in addition to the wuftpd bug] June 2000, by Lamagra Argamal</ref>
}}
| |||