{"id": "OSVDB:5002", "bulletinFamily": "software", "title": "HylaFAX faxgetty TSI Format String DoS", "description": "## Vulnerability Description\nHylaFAX faxgetty contains a flaw that may allow a remote denial of service. The issue is triggered when format string occurs via the TSI data element, which may allow for an attacker to casue the service to stop responding and or execute arbitrary code on the targeted host.\n## Solution Description\nUpgrade to version 4.1.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nHylaFAX faxgetty contains a flaw that may allow a remote denial of service. The issue is triggered when format string occurs via the TSI data element, which may allow for an attacker to casue the service to stop responding and or execute arbitrary code on the targeted host.\n## References:\nVendor URL: http://www.hylafax.org/\n[Vendor Specific Advisory URL](http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2002:055)\n[Vendor Specific Advisory URL](http://www.suse.com/de/security/2002_035_hylafax.html)\n[Vendor Specific Advisory URL](http://www.debian.org/security/2002/dsa-148)\n[Vendor Specific Advisory URL](http://bugs.hylafax.org/bugzilla/show_bug.cgi?id=300)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2002-07/0358.html\nISS X-Force ID: 9728\n[CVE-2002-1049](https://vulners.com/cve/CVE-2002-1049)\nBugtraq ID: 5348\n", "published": "2002-07-29T23:14:19", "modified": "2002-07-29T23:14:19", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://vulners.com/osvdb/OSVDB:5002", "reporter": "Christer Oberg()", "references": [], "cvelist": ["CVE-2002-1049"], "type": "osvdb", "lastseen": "2017-04-28T13:19:59", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "3bc1837181036c07f990d11e9d62bd17"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "eeb736c8ecb83518c461c173037ac0b3"}, {"key": "cvss", "hash": "84813b1457b92d6ba1174abffbb83a2f"}, {"key": "description", "hash": "64eb5505f3763777fa5cf4b19b77563d"}, {"key": "href", "hash": "6836a495794d7714f2395d9c6e86bc11"}, {"key": "modified", "hash": "505fc0350f16135d78a33344cd55a834"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "505fc0350f16135d78a33344cd55a834"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "75dead744d1130c25b773e911db69d89"}, {"key": "title", "hash": "9582260b6e939443138329be0701a390"}, {"key": "type", "hash": "1327ac71f7914948578f08c54f772b10"}], "hash": "50c0255e558666cb369ad2fa984b4ec16ac598c915c7079c2c6fc573fbf236a5", "viewCount": 1, "objectVersion": "1.2", "affectedSoftware": [{"name": "HylaFax", "operator": "eq", "version": "4.0.2"}], "enchantments": {"vulnersScore": 2.8}}

{"result": {"cve": [{"id": "CVE-2002-1049", "type": "cve", "title": "CVE-2002-1049", "description": "Format string vulnerability in HylaFAX faxgetty before 4.1.3 allows remote attackers to cause a denial of service (crash) via the TSI data element.", "published": "2002-10-04T00:00:00", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-1049", "cvelist": ["CVE-2002-1049"], "lastseen": "2016-09-03T03:31:46"}], "suse": [{"id": "SUSE-SA:2002:035", "type": "suse", "title": "remote privilege escalation in hylafax", "description": "HylaFAX is a client-server architecture for receiving and sending facsimiles.", "published": "2002-10-07T09:17:55", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2002-10/msg00007.html", "cvelist": ["CVE-2002-1049", "CVE-2002-1050"], "lastseen": "2016-09-04T11:18:19"}], "nessus": [{"id": "MANDRAKE_MDKSA-2002-055.NASL", "type": "nessus", "title": "Mandrake Linux Security Advisory : hylafax (MDKSA-2002:055)", "description": "Numerous vulnerabilities in the HylaFAX product exist in versions prior to 4.1.3. It does not check the TSI string which is received from remote FAX systems before using it in logging and other places. A remote sender using a specially formatted TSI string can cause the faxgetty program to segfault, resulting in a denial of service. Format string vulnerabilities were also discovered by Christer Oberg, which exist in a number of utilities bundled with HylaFax, such as faxrm, faxalter, faxstat, sendfax, sendpage, and faxwatch. If any of these tools are setuid, they could be used to elevate system privileges.\nMandrake Linux does not, by default, install these tools setuid.\nFinally, Lee Howard discovered that faxgetty would segfault due to a buffer overflow after receiving a very large line of image data. This vulnerability could conceivably be used to execute arbitrary commands on the system as root, and could also be exploited more easily as a denial of sevice.", "published": "2004-07-31T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=13957", "cvelist": ["CVE-2002-1049", "CVE-2001-1034", "CVE-2002-1050"], "lastseen": "2017-10-29T13:42:20"}, {"id": "DEBIAN_DSA-148.NASL", "type": "nessus", "title": "Debian DSA-148-1 : hylafax - buffer overflows and format string vulnerabilities", "description": "A set of problems have been discovered in Hylafax, a flexible client/server fax software distributed with many GNU/Linux distributions. Quoting SecurityFocus the problems are in detail :\n\n - A format string vulnerability makes it possible for users to potentially execute arbitrary code on some implementations. Due to insufficient checking of input, it's possible to execute a format string attack. Since this only affects systems with the faxrm and faxalter programs installed setuid, Debian is not vulnerable.\n - A buffer overflow has been reported in Hylafax. A malicious fax transmission may include a long scan line that will overflow a memory buffer, corrupting adjacent memory. An exploit may result in a denial of service condition, or possibly the execution of arbitrary code with root privileges.\n\n - A format string vulnerability has been discovered in faxgetty. Incoming fax messages include a Transmitting Subscriber Identification (TSI) string, used to identify the sending fax machine. Hylafax uses this data as part of a format string without properly sanitizing the input. Malicious fax data may cause the server to crash, resulting in a denial of service condition.\n\n - Marcin Dawcewicz discovered a format string vulnerability in hfaxd, which will crash hfaxd under certain circumstances. Since Debian doesn't have hfaxd installed setuid root, this problem cannot directly lead into a vulnerability. This has been fixed by Darren Nickerson, which was already present in newer versions, but not in the potato version.\n\nThese problems have been fixed in version 4.0.2-14.3 for the old stable distribution (potato), in version 4.1.1-1.1 for the current stable distribution (woody) and in version 4.1.2-2.1 for the unstable distribution (sid).", "published": "2004-09-29T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=14985", "cvelist": ["CVE-2002-1049", "CVE-2001-0387", "CVE-2001-1034", "CVE-2002-1050"], "lastseen": "2017-10-29T13:38:09"}], "debian": [{"id": "DSA-148", "type": "debian", "title": "hylafax -- buffer overflows and format string vulnerabilities", "description": "A set of problems have been discovered in Hylafax, a flexible client/server fax software distributed with many GNU/Linux distributions. Quoting SecurityFocus the problems are in detail:\n\n * A format string vulnerability makes it possible for users to potentially execute arbitrary code on some implementations. Due to insufficient checking of input, it's possible to execute a format string attack. Since this only affects systems with the faxrm and faxalter programs installed setuid, Debian is not vulnerable.\n * A buffer overflow has been reported in Hylafax. A malicious fax transmission may include a long scan line that will overflow a memory buffer, corrupting adjacent memory. An exploit may result in a denial of service condition, or possibly the execution of arbitrary code with root privileges.\n * A format string vulnerability has been discovered in faxgetty. Incoming fax messages include a Transmitting Subscriber Identification (TSI) string, used to identify the sending fax machine. Hylafax uses this data as part of a format string without properly sanitizing the input. Malicious fax data may cause the server to crash, resulting in a denial of service condition.\n * Marcin Dawcewicz discovered a format string vulnerability in hfaxd, which will crash hfaxd under certain circumstances. Since Debian doesn't have hfaxd installed setuid root, this problem cannot directly lead into a vulnerability. This has been fixed by Darren Nickerson, which was already present in newer versions, but not in the potato version.\n\nThese problems have been fixed in version 4.0.2-14.3 for the old stable distribution (potato), in version 4.1.1-1.1 for the current stable distribution (woody) and in version 4.1.2-2.1 for the unstable distribution (sid).\n\nWe recommend that you upgrade your hylafax packages.", "published": "2002-08-12T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://www.debian.org/security/dsa-148", "cvelist": ["CVE-2002-1049", "CVE-2001-1034", "CVE-2002-1050"], "lastseen": "2016-09-02T18:25:05"}]}}