OpenBSD and NetBSD 'printf(1)' Format String Parsing Denial of Service Vulnerability

Bugtraq ID:	36884
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Oct 30 2009 12:00AM
Updated:	Nov 02 2009 08:37PM
Credit:	Maksymilian Arciemowicz
Vulnerable:	OpenBSD OpenBSD 4.6 NetBSD NetBSD 5.0.1
Not Vulnerable:

OpenBSD and NetBSD 'printf(1)' Format String Parsing Denial of Service Vulnerability

OpenBSD and NetBSD are prone to a denial-of-service vulnerability because they fail to properly parse format strings to the 'printf(1)' function.

An attacker can exploit this issue to cause applications using the vulnerable call to crash with a segmentation fault, denying service to legitimate users.

The following are reported vulnerable:

OpenBSD 4.6
NetBSD 5.0.1

OpenBSD and NetBSD 'printf(1)' Format String Parsing Denial of Service Vulnerability

The following example is available:

printf %*********s 666

OpenBSD and NetBSD 'printf(1)' Format String Parsing Denial of Service Vulnerability

Solution:
Patches for OpenBSD and NetBSD are available. Please see the references for details.

OpenBSD and NetBSD 'printf(1)' Format String Parsing Denial of Service Vulnerability

References:

• Multiple BSD printf(1) and multiple dtoa/*printf(3) vulnerabilities (SecurityReason)
  
• NetBSD Homepage (NetBSD)
  
• OpenBSD Homepage (OpenBSD)
  
• Revision 1.15 (OpenBSD)
  
• Revision 1.33.4.1 (NetBSD)