CWE一覧に戻る
CWE-134

外部制御フォーマット文字列の使用

Use of Externally-Controlled Format String
脆弱性 レビュー中
JA

この製品は、書式文字列を引数として受け取る関数を使用しているが、その書式文字列は外部ソースに由来している。

EN

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Scope: Confidentiality / Impact: Read Memory
Scope: Integrity, Confidentiality, Availability / Impact: Modify Memory; Execute Unauthorized Code or Commands
Choose a language that is not subject to this flaw.
Ensure that all format string functions are passed a static string which cannot be controlled by the user, and that the proper number of arguments are always sent to that function as well. If at all possible, use functions that do not support the %n operator in format strings. [REF-116] [REF-117]
Run compilers and linkers with high warning levels, since they may detect incorrect usage.
MITRE公式ページ — CWE-134