Bug 958312 - FlightGear: improper handling of format strings
Summary: FlightGear: improper handling of format strings
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 958314
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-04-30 21:22 UTC by Vincent Danen
Modified: 2019-09-29 13:03 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-05-29 07:54:59 UTC


Attachments (Terms of Use)

Description Vincent Danen 2013-04-30 21:22:21 UTC
It was reported [1] that FlightGear suffers from improper handling of format strings when FlightGear is started with allowances for remote access (via the --props or --telnet commandline arguments).  If a remote attacker were able to connect to FlightGear and set special parameters related with clouds, it could cause FlightGear to crash.

This is due to the cloud name being used as the format string parameter in the snprintf function in flightgear/src/Environment/fgclouds.cxx, in the FGClouds::buildLayer() function:


176 void FGClouds::buildLayer(int iLayer, const string& name, double coverage) {
...
228                         do {
229                                 variety++;
230                                 snprintf(variety_name, sizeof(variety_name) - 1, cloud_name.c_str(), variety);
231                         } while( box_def_root->getChild(variety_name, 0, false) );


[1] http://kuronosec.blogspot.ca/2013/04/flightgear-remote-format-string.html

Comment 1 Vincent Danen 2013-04-30 21:29:10 UTC
Created FlightGear tracking bugs for this issue

Affects: fedora-all [bug 958314]

Comment 2 Fedora Update System 2013-05-29 00:52:40 UTC
FlightGear-2.8.0-2.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2013-05-29 00:56:49 UTC
FlightGear-2.6.0-3.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2013-05-29 03:01:29 UTC
FlightGear-2.10.0-5.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.