Are format string vulnerabilities only relevant to memory unsafe languages?

[tghosth]

Are format string vulnerabilities only relevant to memory unsafe languages?

Requirement 5.4.2 is in a section that is more about memory unsafe languages but I have two problems:

1. I don't think format string vulnerabilities are only in memory unsafe languages, for example this article also talks about python.
2. This feels more like an input validation or sanitisation requirement and would seem to fit better there.

Any thoughts?

History:

#	Description	L1	L2	L3	CWE
5.4.2	Verify that format strings do not take potentially hostile input, and are constant.		✓	✓	134
5.3.12	Verify that if the application uses a systems language or unmanaged code, format strings do not take potentially hostile input, and are constant.		✓	✓	4.0

[tghosth]

Josh to move this somewhere....

[csfreak92]

Hi @tghosth, I was browsing the other issues and our current ASVS 5.0 repo and I think these requirements 5.4.2 and 5.3.12 you have listed above can fit the Defensive Coding part of this section: https://github.com/elarlang/ASVS/blob/master/5.0/en/0x18-V10-Malicious.md#v104-defensive-coding.

What do you think?

[tghosth]

Hi @tghosth, I was browsing the other issues and our current ASVS 5.0 repo and I think these requirements 5.4.2 and 5.3.12 you have listed above can fit the Defensive Coding part of this section: https://github.com/elarlang/ASVS/blob/master/5.0/en/0x18-V10-Malicious.md#v104-defensive-coding.

What do you think?

I'm not sure I agree @csfreak92 , this seems like a pretty clear cut validation/sanitization. 10.4 is basically for code level requirements with other types of mitigation that don't fit anywhere else :)

I would suggest putting this in "V5.2 Sanitization and Sandboxing" and rewording as follows:

#	Description	L1	L2	L3	CWE
5.2.x	[MODIFIED FROM 5.4.2] Verify that format strings are sanitized before being processed.		✓	✓	134

[csfreak92]

Ah I see, yeah now that I think about it this requirement makes more sense in sanitization chapter. This new modification feels something missing to me. I couldn't place what it is, but maybe we need to clarify what format string vulnerabilities are? Do we have a text in this v5 sanitization chapter to explain it?

[tghosth]

So how about:

#	Description	L1	L2	L3	CWE
5.2.13	[MODIFIED MOVED FROM 5.4.2] Verify that format strings which might resolve in an unexpected or malicious way when used are sanitized before being processed.		✓	✓	134

I think format strings is pretty Googleable

@csfreak92

[tghosth]

@csfreak92 do you still feel we need to add context about format strings? Maybe in a reference?

[csfreak92]

Yeah, a bit more context about format string vulnerabilities would help a long way @tghosth

[jmanico]

PR Submitted