Sorry, my response became detached from the original thread somehow.<br><br><div class="gmail_quote">On Wed, Mar 5, 2008 at 4:29 PM, David Judais &lt;<a href="mailto:david.judais@googlemail.com">david.judais@googlemail.com</a>&gt; wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Why isn&#39;t there a patch?
<div><br></div><div><blockquote class="gmail_quote" style="margin-top:0px;margin-right:0px;margin-bottom:0px;margin-left:0.8ex;border-left-width:1px;border-left-color:rgb(204, 204, 204);border-left-style:solid;padding-left:1ex">

From:&nbsp;<a href="mailto:vashnukad@vashnukad.com" target="_blank"><span style="color:rgb(0, 0, 0);text-decoration:none">vashnukad@vashnukad.com</span></a><br></blockquote><span style="border-collapse:collapse"><div class="gmail_quote">

<blockquote>Site:&nbsp;<a href="http://www.vashnukad.com" target="_blank"><span style="color:rgb(0, 0, 0);text-decoration:none">http://www.vashnukad.com</span></a><br></blockquote><blockquote>
Application: Linux Kiss Server v1.2<br></blockquote><blockquote>Type: Format strings<br></blockquote><blockquote>Priority: Medium<br></blockquote><blockquote>Patch available: No<br></blockquote><blockquote><br></blockquote>

<blockquote>The Linux Kiss Server contains a format strings vulnerability that, if run in foreground mode, can be leveraged for access. The vulnerability is demonstrated in the code below:<br></blockquote><blockquote>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Function log_message():<br>

</blockquote><blockquote>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;if(background_mode == 0)<br></blockquote><blockquote>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;{<br></blockquote><blockquote>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;if(type == &#39;l&#39;)<br></blockquote><blockquote>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;fprintf(stdout,log_msg);<br>

</blockquote><blockquote><br></blockquote><blockquote>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;if(type == &#39;e&#39;)<br></blockquote><blockquote>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;fprintf(stderr,log_msg);<br></blockquote><blockquote>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;free(log_msg);<br>

</blockquote><blockquote>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br></blockquote><blockquote>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<br></blockquote><blockquote><br></blockquote><blockquote>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Function kiss_parse_cmd():<br></blockquote><blockquote><br></blockquote>

<blockquote><br></blockquote><blockquote>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;/* check full command name */<br></blockquote><blockquote>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;if (strncmp(cmd, buf, cmd_len))<br></blockquote><blockquote>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;{<br>

</blockquote><blockquote>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; asprintf(&amp;log_msg,&quot;unknow command: `%s&#39;&quot;, buf);<br></blockquote><blockquote>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; log_message(log_msg,&#39;e&#39;);<br></blockquote><blockquote>

&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; goto error;<br></blockquote><blockquote>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}<br></blockquote><blockquote>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;buf += cmd_len;<br></blockquote><blockquote>&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;<br></blockquote><blockquote>

So putting something like %n%n%n in &#39;buf&#39; you can trigger the vulnerability.<br></blockquote><font color="#888888"><blockquote><br></blockquote><blockquote>--&nbsp;<br></blockquote><blockquote>Name: Vashnukad<br></blockquote>

<blockquote>E-mail:&nbsp;<a href="mailto:vashnukad@vashnukad.com" target="_blank"><span style="color:rgb(136, 136, 136);text-decoration:none">vashnukad@vashnukad.com</span></a><br></blockquote>
<blockquote>Site:&nbsp;<a href="http://www.vashnukad.com" target="_blank"><span style="color:rgb(136, 136, 136);text-decoration:none">http://www.vashnukad.com</span></a><br></blockquote></font></div>
<blockquote><br></blockquote><font color="#888888"><blockquote><br></blockquote><blockquote><br></blockquote><blockquote>--&nbsp;<br></blockquote><blockquote>Name: Vashnukad<br></blockquote><blockquote>e-mail:&nbsp;<a href="mailto:vashnukad@vashnukad.com" target="_blank"><span style="color:rgb(136, 136, 136);text-decoration:none">vashnukad@vashnukad.com</span></a><br>

</blockquote><blockquote>Site:&nbsp;<a href="http://www.vashnukad.com" target="_blank"><span style="color:rgb(136, 136, 136);text-decoration:none">http://www.vashnukad.com</span></a><br></blockquote>
</font></span></div>
</blockquote></div><br>