PHP 4.0 Bug #6351 Updated: '%'-characters in syslog()-function

ID: 6351 User Update by: jjaakkol@cs.helsinki.fi Status: Analyzed Bug Type: Misbehaving function Description: '%'-characters in syslog()-function This kind of "format bugs" have been exploited before. At least wu-ftpd and proftpd have been vulnerable to format bugs. See BugTraq mailing list last july for details (especially the thread "paper: format bugs"). I don't know for sure if this could be exploided in PHP, but my best guess is that it probably could be. IMHO, the best fix would be to just use syslog("%s",string). You only need five more characters but no change in the PHP-syslog function API. Full Bug description available at: http://bugs.php.net/?id=6351