Lucene search

MitreCVE-2004-1097

HistoryJan 10, 2005 - 5:00 a.m.

CVE-2004-1097

2005-01-1005:00:00

mitre

web.nvd.nist.gov

cve

cherokee

format string vulnerability

denial of service

application crash

remote code execution

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

AI Score

7.9

Confidence

High

EPSS

0.018

Percentile

88.1%

JSON

Format string vulnerability in the cherokee_logger_ncsa_write_string function in Cherokee 0.4.17 and earlier, when authenticating via auth_pam, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via format string specifiers in the URL.

Affected configurations

Nvd

Node

cherokeecherokee_httpdMatch0.1

cherokeecherokee_httpdMatch0.1.5

cherokeecherokee_httpdMatch0.1.6

cherokeecherokee_httpdMatch0.2

cherokeecherokee_httpdMatch0.2.5

cherokeecherokee_httpdMatch0.2.6

cherokeecherokee_httpdMatch0.2.7

cherokeecherokee_httpdMatch0.4.6

cherokeecherokee_httpdMatch0.4.7

cherokeecherokee_httpdMatch0.4.8

cherokeecherokee_httpdMatch0.4.17

VendorProductVersionCPE
cherokeecherokee_httpd0.1cpe:2.3:a:cherokee:cherokee_httpd:0.1:*:*:*:*:*:*:*
cherokeecherokee_httpd0.1.5cpe:2.3:a:cherokee:cherokee_httpd:0.1.5:*:*:*:*:*:*:*
cherokeecherokee_httpd0.1.6cpe:2.3:a:cherokee:cherokee_httpd:0.1.6:*:*:*:*:*:*:*
cherokeecherokee_httpd0.2cpe:2.3:a:cherokee:cherokee_httpd:0.2:*:*:*:*:*:*:*
cherokeecherokee_httpd0.2.5cpe:2.3:a:cherokee:cherokee_httpd:0.2.5:*:*:*:*:*:*:*
cherokeecherokee_httpd0.2.6cpe:2.3:a:cherokee:cherokee_httpd:0.2.6:*:*:*:*:*:*:*
cherokeecherokee_httpd0.2.7cpe:2.3:a:cherokee:cherokee_httpd:0.2.7:*:*:*:*:*:*:*
cherokeecherokee_httpd0.4.6cpe:2.3:a:cherokee:cherokee_httpd:0.4.6:*:*:*:*:*:*:*
cherokeecherokee_httpd0.4.7cpe:2.3:a:cherokee:cherokee_httpd:0.4.7:*:*:*:*:*:*:*
cherokeecherokee_httpd0.4.8cpe:2.3:a:cherokee:cherokee_httpd:0.4.8:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cherokee	cherokee_httpd	0.1	cpe:2.3:a:cherokee:cherokee_httpd:0.1:::::::*
cherokee	cherokee_httpd	0.1.5	cpe:2.3:a:cherokee:cherokee_httpd:0.1.5:::::::*
cherokee	cherokee_httpd	0.1.6	cpe:2.3:a:cherokee:cherokee_httpd:0.1.6:::::::*
cherokee	cherokee_httpd	0.2	cpe:2.3:a:cherokee:cherokee_httpd:0.2:::::::*
cherokee	cherokee_httpd	0.2.5	cpe:2.3:a:cherokee:cherokee_httpd:0.2.5:::::::*
cherokee	cherokee_httpd	0.2.6	cpe:2.3:a:cherokee:cherokee_httpd:0.2.6:::::::*
cherokee	cherokee_httpd	0.2.7	cpe:2.3:a:cherokee:cherokee_httpd:0.2.7:::::::*
cherokee	cherokee_httpd	0.4.6	cpe:2.3:a:cherokee:cherokee_httpd:0.4.6:::::::*
cherokee	cherokee_httpd	0.4.7	cpe:2.3:a:cherokee:cherokee_httpd:0.4.7:::::::*
cherokee	cherokee_httpd	0.4.8	cpe:2.3:a:cherokee:cherokee_httpd:0.4.8:::::::*

Rows per page:

1-10 of 111

References

bugs.gentoo.org/show_bug.cgi?id=67667

www.gentoo.org/security/en/glsa/glsa-200411-02.xml

www.securityfocus.com/bid/11574

exchange.xforce.ibmcloud.com/vulnerabilities/17934

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

AI Score

7.9

Confidence

High

EPSS

0.018

Percentile

88.1%

JSON

Related for CVE-2004-1097