I don't understand this security hole.

Here is the buggy c code

Code:

---

include <stdio.h>
#include <stdlib.h>

#define MAX 8

int main(void) {

    char namebuf[MAX];

    printf("Enter your name: "); fgets(namebuf,5,stdin);

    printf(namebuf);

    return 0;
}

---

$gdb over
GNU gdb 6.1
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i586-suse-linux"...Using host libthread_db library "/lib/tls/libthread_db.so.1".

(gdb) run
Starting program: /home/cdalten/over
Enter your name: %s

Program received signal SIGSEGV, Segmentation fault.
0x400913cb in strlen () from /lib/tls/libc.so.6
(gdb) bt
#0 0x400913cb in strlen () from /lib/tls/libc.so.6
#1 0x40066c76 in vfprintf () from /lib/tls/libc.so.6
#2 0x4006c310 in printf () from /lib/tls/libc.so.6
#3 0x0804842f in main () at over.c:12
(gdb) q
The program is running. Exit anyway? (y or n) y

I know the bug is in this line

Code:

---

printf(namebuf);

---

It has something due with the fact printf() has been passed an unchecked string. But that is about is. Would someone care to enlighten me on what is going on?

printf was designed to validate format strings and write. You could type

Code:

---

printf("%8s", namebuf);

---

or if it makes no difference whether a newline is there

Code:

---

puts(namebuf);

---

Code:

---

printf("%8s", namebuf);

---

or just

Code:

---

printf("%s", namebuf);

---

If you call printf() like

Code:

---

printf("%s");

---

(which is what your code does if you enter "%s"), it will see the %s in the format string and expect a char pointer. It will get 4 bytes* off the stack, assuming it's a char pointer. But it;s really garbage, whatever happened to be there, because you didn't pass a char pointer to printf().

* On a 32-bit machine.

http://en.wikipedia.org/wiki/Format_string_attack

If I manage to get some shellcode into the program stack/heap, I could exploit your format string (if it is user-accessible) and try to get the CPU instruction register to point to my shell code and execute it. If the shellcode opened remote shell access to me on your server, you're practically *splat*.