From owner-freebsd-security  Mon Apr 29 17:41:31 2002
Delivered-To: freebsd-security@freebsd.org
Received: from mailout08.sul.t-online.com (mailout08.sul.t-online.com [194.25.134.20])
	by hub.freebsd.org (Postfix) with ESMTP id 8B95637B419
	for <freebsd-security@freebsd.org>; Mon, 29 Apr 2002 17:41:28 -0700 (PDT)
Received: from fwd01.sul.t-online.de 
	by mailout08.sul.t-online.com with smtp 
	id 172J1A-0006CV-0A; Mon, 29 Apr 2002 23:49:08 +0200
Received: from pc5.abc (520067998749-0001@[217.233.97.188]) by fmrl01.sul.t-online.com
	with esmtp id 172J14-08YzRIC; Mon, 29 Apr 2002 23:49:02 +0200
Received: (from nicolas@localhost)
	by pc5.abc (8.11.6/8.11.6) id g3TLn0P36526
	for freebsd-security@FreeBSD.ORG; Mon, 29 Apr 2002 23:49:00 +0200 (CEST)
	(envelope-from list@rachinsky.de)
Date: Mon, 29 Apr 2002 23:49:00 +0200
From: Nicolas Rachinsky <list@rachinsky.de>
To: freebsd-security@FreeBSD.ORG
Subject: Re: syslogd security bug?
Message-ID: <20020429214859.GD36316@pc5.abc>
Mail-Followup-To: freebsd-security@FreeBSD.ORG
References: <20020429233943.A213@microsoft.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20020429233943.A213@microsoft.com>
User-Agent: Mutt/1.3.28i
X-Powered-by: FreeBSD
X-Homepage: http://www.rachinsky.de
X-PGP-Keyid: C11ABC0E
X-PGP-Fingerprint: 19DB 8392 8FE0 814A 7362  EEBD A53B 526A C11A BC0E
X-PGP-Key: http://www.rachinsky.de/nicolas/nicolas_rachinsky.asc
X-Sender: 520067998749-0001@t-dialin.net
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

* Piotr Wiejaczka <wiejak@alpha.net.pl> [2002-04-29 23:39:44 +0200]:
> Hi all.
> 
> %uname -a
> FreeBSD localhost 4.5-STABLE FreeBSD 4.5-STABLE #1: Tue Mar 12 08:20:11 CET
> 2002     root@:/usr/src/sys/compile/OKO2  i386
> 
> %cat syslog.c
> #include <syslog.h>
> #include <stdarg.h>
>  
> int main(int argc, char *argv[])
> {
>         syslog(LOG_EMERG, argv[1]);
> }
>  
> %./syslog "blah %x %x %x %x"
>  
> Message from syslogd@localhost at Mon Apr 29 23:27:35 2002 ...
> localhost syslog: blah 2807aebe 2 bfbffc5c bfbffd26
> 
>  
> Looks like we have a format string bug inside syslogd :) 

man 3 syslog

I think this is the intended behaviour, the format string bug is in
your program.

Nicolas

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message