CVE-2004-0561

Step 1: Payload Delivery: An attacker sends a specially crafted Gopher request to the gopherd server. This request contains a malicious payload designed to exploit the format string vulnerability.

Step 2: Log Routine Trigger: The gopherd server processes the malicious request. The crafted payload, which includes format string specifiers, is passed to the log routine for logging.

Step 3: Format String Execution: The log routine, due to the lack of input sanitization, interprets the format string specifiers within the attacker's payload.

Step 4: Memory Manipulation: The format string specifiers allow the attacker to read from or write to arbitrary memory locations. This can lead to information disclosure, denial of service, or, potentially, remote code execution.

Step 5: Denial of Service or Code Execution: Depending on the crafted payload, the server either crashes (DoS) or executes attacker-controlled code (RCE).

Root Cause: The vulnerability lies within the log routine of gopherd 3.0.3. The log function, responsible for writing log messages, fails to properly sanitize user-supplied input before passing it to format string functions like printf or fprintf. This allows an attacker to craft malicious input containing format string specifiers (e.g., %x, %s, %n) that are interpreted by the function. By carefully crafting these specifiers, an attacker can read from or write to arbitrary memory locations. This can lead to a denial of service by crashing the daemon or, in a more severe case, remote code execution by overwriting critical program data or control flow. The lack of input validation and improper use of format string functions are the core of this vulnerability.