Format String Attacks in a non-C/C++ environment
February 5, 2008
A ton of people are under the impression that format string attacks are only a C/C++ vulnerability (as in, if you code in a different language, you are safe).First, read this article
Second, try this bit of C#
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
namespace FormatStringsC
{
class Program
{
static void Main(string[] args)
{
try
{
// if I was a user inputted string you would be in trouble
String fspec = "{1},{10}";
Console.Write(fspec, "I don’t know but ", " I’ve been told ");
// return 0;
}
//generic catch all
catch (Exception e)
{
Console.WriteLine("Oops! Shutting down app\n");
}
}
}
}
Third, keep watching this space for examples in other languages
Leave a Reply