Re: format strings vulns in /bin/login and /usr/bin/passwd

Faulty,

         Just because there's a *printf function called from the code doesn't mean it's vuln. They'd have to overwrite data somewhere by possible mis-use of the function(s). I do not know which flavor of Unix this is from, so I'm unabel to look over the source code at those lines specified.

         Perhaps you need to look at them and see if they don't use any format strings and instead just pass variables -- that's always a tell-tale sign :)

Brandon E. Erhart

At 02:19 AM 1/26/2003, Faulty@b0f.net www.b0f.net wrote:

>Hello while doing a scan for format strings vulns on util-linux package
Received on Mon Jan 27 12:10:42 2003