Open Source Zealots Dowplay Danger Of Perl Flaw On ZDNet Talkbacks

TalkBack 2 of 30:

Next »

« Previous

• Thread View
• Flat View

nope - and here are the details

Naw, it's a bug in the open-source PERL app "webmin". They used the PERL syslog call incorrectly. That's not to say that the same class of problem might not exist in other applications, if they are also coded to stuff user-supplied text into a format string, which is pretty dumb.

What happened in webmin is that, instead of providing a static format to syslog, plus arguments, they passed the arguments in the format itself. In other words instead of saying

printf "%s", "long string with $user supplied values";

the code essentially did this:

printf "long string with $user supplied values";

where that long string becomes the format, and there are no actual arguments.

Is this exploitable in any application that uses PERL? No. Is it possible that some PERL-based applications have the bug? Yes, but at a very low probability - the coder has to be using formats incorrectly AND put user-supplied data in them.

P.S. - I have not yet seen an explanation, much less an example, of how one goes from the format vulnerability to an actual compromise - it would still be necessary to overwrite code somewhere that, when invoked as root, would execute malicious code.

Posted by: GDF   Posted on: 11/30/05 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• The Impact of Virtualization Software on Operating Environments VMware Today's use of virtualization technology allows IT professionals to ... Download Now