CWE-134: Use of Externally-Controlled Format String (Base)

Description: The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Extended Description: When an attacker can modify an externally-controlled format string, this can lead to buffer overflows, denial of service, or data representation problems. It should be noted that in some circumstances, such as internationalization, the set of format strings is externally controlled by design. If the source of these format strings is trusted (e.g. only contained in library files that are only modifiable by the system administrator), then the external control might not itself pose a vulnerability.



Applicable Platforms: ::LANGUAGE NAME:C:LANGUAGE PREVALENCE:Often::LANGUAGE NAME:C++:LANGUAGE PREVALENCE:Often::LANGUAGE NAME:Perl:LANGUAGE PREVALENCE:Rarely::

Modes of Introduction: ::PHASE:Implementation:NOTE:The programmer rarely intends for a format string to be externally-controlled at all. This weakness is frequently introduced in code that constructs log messages, where a constant format string is omitted.::PHASE:Implementation:NOTE:In cases such as localization and internationalization, the language-specific message repositories could be an avenue for exploitation, but the format string issue would be resultant, since attacker control of those repositories would also allow modification of message length, format, and content.::



Common Consequences: ::SCOPE:Confidentiality:IMPACT:Read Memory:NOTE:Format string problems allow for information disclosure which can severely simplify exploitation of the program.::SCOPE:Integrity:SCOPE:Confidentiality:SCOPE:Availability:IMPACT:Modify Memory:IMPACT:Execute Unauthorized Code or Commands:NOTE:Format string problems can result in the execution of arbitrary code.::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:This weakness can often be detected using automated static analysis tools. Many modern tools use data flow analysis or constraint-based techniques to minimize the number of false positives.::METHOD:Black Box:DESCRIPTION:Since format strings often occur in rarely-occurring erroneous conditions (e.g. for error message logging), they can be difficult to detect using black box methods. It is highly likely that many latent issues exist in executables that do not have associated source code (or equivalent source.:EFFECTIVENESS:Limited::METHOD:Automated Static Analysis - Binary or Bytecode:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Bytecode Weakness Analysis - including disassembler + source code weakness analysis Binary Weakness Analysis - including disassembler + source code weakness analysis Cost effective for partial coverage: Binary / Bytecode simple extractor - strings, ELF readers, etc.:EFFECTIVENESS:High::METHOD:Manual Static Analysis - Binary or Bytecode:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies:EFFECTIVENESS:SOAR Partial::METHOD:Dynamic Analysis with Automated Results Interpretation:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Web Application Scanner Web Services Scanner Database Scanners:EFFECTIVENESS:SOAR Partial::METHOD:Dynamic Analysis with Manual Results Interpretation:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Fuzz Tester Framework-based Fuzzer:EFFECTIVENESS:SOAR Partial::METHOD:Manual Static Analysis - Source Code:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Manual Source Code Review (not inspections) Cost effective for partial coverage: Focused Manual Spotcheck - Focused manual analysis of source:EFFECTIVENESS:High::METHOD:Automated Static Analysis - Source Code:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer Cost effective for partial coverage: Warning Flags:EFFECTIVENESS:High::METHOD:Architecture or Design Review:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Requirements:DESCRIPTION:Choose a language that is not subject to this flaw.::PHASE:Implementation:DESCRIPTION:Ensure that all format string functions are passed a static string which cannot be controlled by the user, and that the proper number of arguments are always sent to that function as well. If at all possible, use functions that do not support the %n operator in format strings. [REF-116] [REF-117]::PHASE:Build and Compilation:DESCRIPTION:Run compilers and linkers with high warning levels, since they may detect incorrect usage.::

Observed Examples: ::REFERENCE:CVE-2002-1825:DESCRIPTION:format string in Perl program:LINK:https://www.cve.org/CVERecord?id=CVE-2002-1825::REFERENCE:CVE-2001-0717:DESCRIPTION:format string in bad call to syslog function:LINK:https://www.cve.org/CVERecord?id=CVE-2001-0717::REFERENCE:CVE-2002-0573:DESCRIPTION:format string in bad call to syslog function:LINK:https://www.cve.org/CVERecord?id=CVE-2002-0573::REFERENCE:CVE-2002-1788:DESCRIPTION:format strings in NNTP server responses:LINK:https://www.cve.org/CVERecord?id=CVE-2002-1788::REFERENCE:CVE-2006-2480:DESCRIPTION:Format string vulnerability exploited by triggering errors or warnings, as demonstrated via format string specifiers in a .bmp filename.:LINK:https://www.cve.org/CVERecord?id=CVE-2006-2480::REFERENCE:CVE-2007-2027:DESCRIPTION:Chain: untrusted search path enabling resultant format string by loading malicious internationalization messages:LINK:https://www.cve.org/CVERecord?id=CVE-2007-2027::

Functional Areas: ::Logging::Error Handling::String Processing::

Affected Resources: ::Memory::

Notes: ::TYPE:Applicable Platform:NOTE:This weakness is possible in any programming language that support format strings.::TYPE:Other:NOTE:While Format String vulnerabilities typically fall under the Buffer Overflow category, technically they are not overflowed buffers. The Format String vulnerability is fairly new (circa 1999) and stems from the fact that there is no realistic way for a function that takes a variable number of arguments to determine just how many arguments were passed in. The most common functions that take a variable number of arguments, including C-runtime functions, are the printf() family of calls. The Format String problem appears in a number of ways. A *printf() call without a format specifier is dangerous and can be exploited. For example, printf(input); is exploitable, while printf(y, input); is not exploitable in that context. The result of the first call, used incorrectly, allows for an attacker to be able to peek at stack memory since the input string will be used as the format specifier. The attacker can stuff the input string with format specifiers and begin reading stack values, since the remaining parameters will be pulled from the stack. Worst case, this improper use may give away enough control to allow an arbitrary value (or values in the case of an exploit program) to be written into the memory of the running program. Frequently targeted entities are file names, process names, identifiers. Format string problems are a classic C/C++ issue that are now rare due to the ease of discovery. One main reason format string vulnerabilities can be exploited is due to the %n operator. The %n operator will write the number of characters, which have been printed by the format string therefore far, to the memory pointed to by its argument. Through skilled creation of a format string, a malicious user may use values on the stack to create a write-what-where condition. Once this is achieved, they can execute arbitrary code. Other operators can be used as well; for example, a %9999s operator could also trigger a buffer overflow, or when used in file-formatting functions like fprintf, it can generate a much larger output than intended.::TYPE:Research Gap:NOTE:Format string issues are under-studied for languages other than C. Memory or disk consumption, control flow or variable alteration, and data corruption may result from format string exploitation in applications written in other languages such as Perl, PHP, Python, etc.::