Re: Nagios format string issues

["Steven M. Christey" <coley () linus mitre org>]

On Wed, 6 Oct 2010, Josh Bressers wrote:

> ----- "Oden Eriksson" <oeriksson () mandriva com> wrote:
>
> > Just checked the ones I fixed (in 2008/2009):
> >
> > $ rpm -qlp /SRPMS/contrib/release/*.rpm /SRPMS/main/release/*.rpm |
> > grep
> > format_not_a_string_literal_and_no_format_arguments | wc -l
> > 106
> >
> > So, at least 106 new CVE assignments there.
>
> It's probably not 106. Just becuase something isn't using format arguments
> doesn't mean it's a security flaw. Some subset of these probably could be
> considered security flaws though.

I agree.  Closer inspection is necessary.  Some of these variables could 
be hard-coded constants.  Sounds like there could be a lot, though.

- Steve