Multiple BSD Distributions 'printf(3)' Memory Corruption Vulnerability

Bugtraq ID:	36885
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Oct 30 2009 12:00AM
Updated:	Nov 02 2009 09:17PM
Credit:	Maksymilian Arciemowicz
Vulnerable:	OpenBSD OpenBSD 4.6 NetBSD NetBSD 5.0.1
Not Vulnerable:

Multiple BSD Distributions 'printf(3)' Memory Corruption Vulnerability

Multiple BSD distributions are prone to a memory-corruption vulnerability because the software fails to properly bounds-check data used as an array index.

An attacker can exploit this issue to cause applications to crash with a segmentation fault, denying service to legitimate users. Given the nature of this issue, the attacker may also be able to run arbitrary code, but this has not been confirmed.

The following are vulnerable:

OpenBSD 4.6
NetBSD 5.0.1

Multiple BSD Distributions 'printf(3)' Memory Corruption Vulnerability

The following example is available:

printf %.1100000000f 1.1

Multiple BSD Distributions 'printf(3)' Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references for details.

Multiple BSD Distributions 'printf(3)' Memory Corruption Vulnerability

References:

• Multiple BSD printf(1) and multiple dtoa/*printf(3) vulnerabilities (SecurityReason)
  
• NetBSD Homepage (NetBSD)
  
• OpenBSD Homepage (OpenBSD)