OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: remote crash BitchX 1.0c16
From: Antonomasia (antNOTATLA.DEMON.CO.UK)
Date: Wed Jul 05 2000 - 15:21:07 CDT

Colten Edwards <edwards bitchx.dimension6.com>:

> There's a small bug in the latest BitchX in which a nasty user can invite
> you to a channel with a %s in it...

> This is a classic case of printf(variable); where variable contains
> formatting chars.

For a crude Perl scanner for these bugs you could try
    http://www.notatla.demon.co.uk/SOFTWARE/SCANNER/argcount.plx
which arose out of discussion on the linux security audit list. 

--
##############################################################
# Antonomasia   antnotatla.demon.co.uk                      #
# See http://www.notatla.demon.co.uk/                        #
##############################################################