CWE-134: Use of Externally-Controlled Format String

Description:
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Affected languages: Not Language-Specific, C, C++, Perl
Parent weaknesses: CWE-668, CWE-668, CWE-20

Consequences:
  - Confidentiality: Read Memory
  - Integrity: Modify Memory

Detection methods:
  - Automated Static Analysis: This weakness can often be detected using automated static analysis tools. Many modern tools use data flow analysis or constraint-based techniques to minimize the number of false positives.
  - Black Box: Since format strings often occur in rarely-occurring erroneous conditions (e.g. for error message logging), they can be difficult to detect using black box methods. It is highly likely that many laten
  - Automated Static Analysis - Binary or Bytecode: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Highly cost effective: 
                         
                           
  - Manual Static Analysis - Binary or Bytecode: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             

Mitigations:
  - [Requirements] Choose a language that is not subject to this flaw.
  - [Implementation] Ensure that all format string functions are passed a static string which cannot be controlled by the user, and that the proper number of arguments are always sent to that function as well. If at all possible, use functions that do not support the %n operator in format strings. [REF-116] [REF-117]
  - [Build and Compilation] Run compilers and linkers with high warning levels, since they may detect incorrect usage.

Demonstrative examples:
The following program prints a string provided as an argument.
The example is exploitable, because of the call to printf() in the printWrapper() function. Note: The stack buffer was added to make exploitation more simple.
#include <stdio.h> 
                      void printWrapper(char *string) { 
                         
                            printf(string); 
                      } 
                      int main(int argc, char **argv) { 
                         
                            char buf[5012]; memcpy(buf, argv[1], 5012); printWrapper(argv[1]); return (0); 
                      }

The following code copies a command line argument into a buffer using snprintf().
This code allows an attacker to view the contents of the stack and write to the stack using a command line argument containing a sequence of formatting directives. The attacker can read from the stack by providing more formatting directives, such as %x, than the function takes as arguments to be formatted. (In this example, the function takes no arguments to be formatted.) By using the %n formatting directive, the attacker can write to the stack, causing snprintf() to write the number of bytes output thus far to the specified argument (rather than reading a value from the argument, which is the intended behavior). A sophisticated version of this attack will use four staggered writes to completely control the 

Real-world examples:
  - CVE-2002-1825: format string in Perl program
  - CVE-2001-0717: format string in bad call to syslog function
  - CVE-2002-0573: format string in bad call to syslog function
  - CVE-2002-1788: format strings in NNTP server responses
  - CVE-2006-2480: Format string vulnerability exploited by triggering errors or warnings, as demonstrated via format string specifiers in a .bmp filename.