Week 3

Question 1

What are the format string vulnerabilities?

Answer 1

1. Leak information from the stack - less arguments
2. Crash the program - missing argument
3. Modify the memory - &i

Question 2

How to avoid format string vulnerabilities?

Answer 2

1. Hard code format strings - printf(“%s”, user_data)
2. Don’t use %n - they overwrite memory address
3. Compiler can be used to match printf arguments to format strings