btbars / unix-privesc-check

Automatically exported from code.google.com/p/unix-privesc-check
0 stars 0 forks source link

Fix printf format string for sudoers #41

Open GoogleCodeExporter opened 8 years ago

GoogleCodeExporter commented 8 years ago
The first argument to printf is often passed directly from the sudoers file. 
This can cause problems because this file commonly contains % characters for 
group definitions. This is noted in the comment in lib/misc/sudo: "# FIXME this 
printf fails when the an entry starts with percentage character (%) which is 
common for sudoers group".

Fixed this by using a simple format string, "%s", as the first argument. In the 
particular case after the comment I also added a new line to the string to fix 
a bug which leaves the final sudoers entry unprocessed.

Similar fixes should be done throughout the code base, but I just targeted code 
affected by the sudoers file here (privileged_writable really).

Original issue reported on code.google.com by JJC...@googlemail.com on 24 Feb 2015 at 4:20

Attachments: