Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 6 Oct 2010 21:56:09 +0200
From: Oden Eriksson <>
Cc: Josh Bressers <>
Subject: Re: Nagios format string issues

onsdagen den 6 oktober 2010 16.46.54 skrev  Josh Bressers:
> ----- "Oden Eriksson" <> wrote:
> > We have a whole bunch of similar patches in Mandriva, just fetch the
> > cooker source rpm packages and do something like:
> > 
> > rpm -qlp *.src,rpm | grep format
> > 
> > It would be a major task to push that to the upstream projects.
> > 
> > Just checked the ones I fixed (in 2008/2009):
> > 
> > $ rpm -qlp /SRPMS/contrib/release/*.rpm /SRPMS/main/release/*.rpm |
> > grep
> > format_not_a_string_literal_and_no_format_arguments | wc -l
> > 106
> > 
> > So, at least 106 new CVE assignments there.
> It's probably not 106. Just becuase something isn't using format arguments
> doesn't mean it's a security flaw. Some subset of these probably could be
> considered security flaws though.
> Does anyone know any tricks for wading through this many patches?
> It would be wise to see about initiating a process to get these upstream.
> Thanks.


I just extracted the patches I made at the time. I cannot tell which of them 
deserves CVE assignments though. I have put them here:

These are only the ones I fixed. I intentionally named the patches with the 
long funny name *format_not_a_string_literal_and_no_format_arguments* so that 
I could easily tell what I touched. There are more patches named differently 
like "*str*fmt*" or something similar, so someone with a lot of free time 
should probably look deeper into this.

Anyone can extract the patches or look in our svn for more clues. I'm sorry 
for not having the time to send the patches upstream. However some of our 
patches have made it upstream but I have lost track, sorry.

I hope it helps.

Regards // Oden Eriksson
Security team manager - Mandriva

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.