Format string

🗓️ 20 Apr 2010 14:30:00Reported by PRIOn knowledge baseType

Multiple format string vulnerabilities in the tolog function in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b, and 1.5 allow remote attackers to execute arbitrary code via format string specifiers in a GET request to the HTTP server component when logging is enabled, and allow remote authenticated users to execute arbitrary code via format string specifiers in a PWD command to the FTP server component

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2009-4769	20 Apr 201014:30	–	attackerkb
Circl	CVE-2009-4769	25 Aug 201000:00	–	circl
CVE	CVE-2009-4769	20 Apr 201014:00	–	cve
Cvelist	CVE-2009-4769	20 Apr 201014:00	–	cvelist
Exploit DB	httpdx - 'tolog()' Format String (Metasploit) (1)	25 Aug 201000:00	–	exploitdb
Exploit DB	httpdx - 'tolog()' Format String (Metasploit) (2)	25 Aug 201000:00	–	exploitdb
Metasploit	HTTPDX tolog() Function Format String Vulnerability	17 Nov 200923:54	–	metasploit
Metasploit	HTTPDX tolog() Function Format String Vulnerability	18 Nov 200904:16	–	metasploit
NVD	CVE-2009-4769	20 Apr 201014:30	–	nvd
OpenVAS	httpdx Multiple Vulnerabilities	26 Jul 201000:00	–	openvas

Source	Link
metasploit	www.metasploit.com/redmine/projects/framework/repository/revisions/7569/entry/modules/exploits/windows/ftp/httpdx_tolog_format.rb
osvdb	www.osvdb.org/60181
vupen	www.vupen.com/english/advisories/2009/3312
metasploit	www.metasploit.com/redmine/projects/framework/repository/revisions/7569/entry/modules/exploits/windows/http/httpdx_tolog_format.rb
osvdb	www.osvdb.org/60182

07 Jun 2010 04:00Current

8.1High risk

Vulners AI Score8.1

EPSS0.62136