RE: syslogd security bug?

From: DiCioccio, Jason (jdicioccio@epylon.com)
Date: 04/30/02 

From: "DiCioccio, Jason" <jdicioccio@epylon.com>
To: 'Piotr Wiejaczka' <wiejak@alpha.net.pl>, freebsd-security@FreeBSD.ORG
Date: Mon, 29 Apr 2002 15:28:37 -0700

 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

cat syslog.c | sed 's/LOG_EMERG, argv\[1\]/LOG_EMERG, "%s", argv\[1\]/'

Cheers,
- -JD-

- -----Original Message-----
From: Piotr Wiejaczka [mailto:wiejak@alpha.net.pl]
Sent: Monday, April 29, 2002 2:40 PM
To: freebsd-security@FreeBSD.ORG
Subject: syslogd security bug?

Hi all.

%uname -a
FreeBSD localhost 4.5-STABLE FreeBSD 4.5-STABLE #1: Tue Mar 12 08:20:11 CET
2002 root@:/usr/src/sys/compile/OKO2 i386

%cat syslog.c
#include <syslog.h>
#include <stdarg.h>
 
int main(int argc, char *argv[])
{
        syslog(LOG_EMERG, argv[1]);
}
 
%./syslog "blah %x %x %x %x"
 
Message from syslogd@localhost at Mon Apr 29 23:27:35 2002 ...
localhost syslog: blah 2807aebe 2 bfbffc5c bfbffd26

 
Looks like we have a format string bug inside syslogd :)

- --
wiejak
FidoNet: 2:484/2.76
mailto: wiejak <at> alpha.net.pl

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

-----BEGIN PGP SIGNATURE-----
Version: PGP 7.0.4

iQA/AwUBPM3LYb8+wXo6G32BEQLQpgCeNjxupRIWRaShPU4Nf+K4HVDyN7cAoOHY
41sdBbuM+pzQPUkVAy37ZSpb
=kpEb
-----END PGP SIGNATURE-----

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message