By Stephen Shankland
Staff Writer, CNET News.com
September 7, 2000, 12:45 p.m. PT
Security experts have uncovered a new class of vulnerabilities in Unix and Linux systems that let attackers take full control of computers.
These "format string" vulnerabilities started surfacing about two months ago, said Elias Levy, a moderator of the Bugtraq computer security mailing list. Some of them have lurked for years in basic Unix programs, but security experts only now have begun to find and fix them.
To take advantage of a format string vulnerability, an attacker gets a computer to display a string of text characters with formatting commands. By carefully manipulating the formatting commands, the attacker can trick the computer into running a program.
"Format string bugs are the new trend in computer security vulnerabilities," said Ivan Arce, president of Argentinian security company Core SDI and discoverer of the "locale" format string vulnerability that became public last Friday.
Complete Article: http://news.cnet.com/news/0-1003-200-2719802.html?tag=st.ne.1002.lthd.1003-200-2719802
