Description
The printf wrappers in libsafe 2.0-11 and earlier do not properly handle argument indexing specifiers, which could allow attackers to exploit certain function calls through arguments that are not verified by libsafe.
References
- 20020320 [VulnWatch] Bypassing libsafe format string protection mailing-list
- libsafe-argnum-protection-bypass(8594) vdb-entry
- 20020320 Bypassing libsafe format string protection mailing-list
- 4327 vdb-entry
- MDKSA-2002:026 vendor-advisory