pentestmonkey/unix-privesc-check

Fix printf format string for sudoers

GoogleCodeExporter opened this issue · 0 comments

The first argument to printf is often passed directly from the sudoers file. 
This can cause problems because this file commonly contains % characters for 
group definitions. This is noted in the comment in lib/misc/sudo: "# FIXME this 
printf fails when the an entry starts with percentage character (%) which is 
common for sudoers group".

Fixed this by using a simple format string, "%s", as the first argument. In the 
particular case after the comment I also added a new line to the string to fix 
a bug which leaves the final sudoers entry unprocessed.

Similar fixes should be done throughout the code base, but I just targeted code 
affected by the sudoers file here (privileged_writable really).


Original issue reported on code.google.com by JJC...@googlemail.com on 24 Feb 2015 at 4:20

Attachments: