[Full-Disclosure] gnu-less Format String Vulnerability

[Serkan Akpolat]

+-----[ Software ]-----+

Less is a program similar to more, but which allows backward movement in
the file as well as forward movement. Also, less does not have to read
the entire input file before starting, so with large input files it 
starts up faster than text editors like vi.
Less uses termcap (or terminfo on some systems), so it can run on a 
variety of terminals. There is even limited support for hardcopy terminals.

+-----[ Tested Versions ]-----+

less-382
less-381
less-358

+-----[ Description ]-----+

Format string vulnerability.


+-----[ Vulnerable Code ]-----+
 From less-382:

[filename.c] : 787

     public char *
open_altfile(filename, pf, pfd)
     char *filename;
     int *pf;
     void **pfd;
{
     ...................
     if ((lessopen = lgetenv("LESSOPEN")) == NULL
     ...................
     sprintf(cmd, lessopen, filename); <-- Format String Problem Here
     ...................

}

+-----[ Greets  ]-------+

Virulent , gorny and all other netricians

+-----------------------+

+-----[ Contact ]-----+

http://deicide.siyahsapka.org

        deicide at siyahsapka.org

+----------------------+