It was reported [1] that FlightGear suffers from improper handling of format strings when FlightGear is started with allowances for remote access (via the --props or --telnet commandline arguments).  If a remote attacker were able to connect to FlightGear and set special parameters related with clouds, it could cause FlightGear to crash.

This is due to the cloud name being used as the format string parameter in the snprintf function in flightgear/src/Environment/fgclouds.cxx, in the FGClouds::buildLayer() function:


176 void FGClouds::buildLayer(int iLayer, const string& name, double coverage) {
...
228                         do {
229                                 variety++;
230                                 snprintf(variety_name, sizeof(variety_name) - 1, cloud_name.c_str(), variety);
231                         } while( box_def_root->getChild(variety_name, 0, false) );


[1] http://kuronosec.blogspot.ca/2013/04/flightgear-remote-format-string.html