RHEL 2.1 : tripwire (RHSA-2004:244)

Updated Tripwire packages that fix a format string security vulnerability are now available. Tripwire is a system integrity assessment tool. Paul Herman discovered a format string vulnerability in Tripwire version 2.3.1 and earlier. If Tripwire is configured to send reports via email, a local use...

RHEL 2.1 : mc (RHSA-2004:172)

Updated mc packages that resolve several buffer overflow vulnerabilities, one format string vulnerability and several temporary file creation vulnerabilities are now available. Midnight Commander mc is a visual shell much like a file manager. Several buffer overflows, several temporary file...

RHEL 2.1 : cadaver (RHSA-2004:157)

An updated cadaver package that fixes a vulnerability in neon exploitable by a malicious DAV server is now available. cadaver is a command-line WebDAV client that uses inbuilt code from neon, an HTTP and WebDAV client library. Versions of the neon client library up to and including 0.24.4 have be...

RHEL 2.1 : metamail (RHSA-2004:073)

Updated metamail packages that fix a number of vulnerabilities are now available. Metamail is a system for handling multimedia mail. Ulf Harnhammar discovered two format string bugs and two buffer overflow bugs in versions of Metamail up to and including 2.7. An attacker could create a...

FreeBSD : Midnight Commander buffer overflows, format string bugs, and insecure temporary file handling (106)

The following package needs to be updated: mc %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg0c6f3fde9c5111d893660020ed76ef5a.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright 2003-2006...

FreeBSD : GNU Anubis buffer overflows and format string vulnerabilities (6)

The following package needs to be updated: anubis %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg8471bb856fb011d8873f0020ed76ef5a.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright...

FreeBSD : Buffer overflows and format string bugs in Emil (39)

The following package needs to be updated: emil %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkgce46b93a80f211d896450020ed76ef5a.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright 2003-200...

CVE-2004-0451

Multiple format string vulnerabilities in the 1 logquit, 2 logerr, or 3 loginfo functions in Software Upgrade Protocol SUP allows remote attackers to execute arbitrary code via format string specifiers in messages that are logged by syslog...

CVE-2004-0393

Format string vulnerability in the msg function for rlpr daemon rlprd 2.0.4 allows remote attackers to execute arbitrary code via format string specifiers in a buffer that can not be resolved, which is provided to the syslog function...

CVE-2004-0623

GNU GNATS 4.00 is affected by a format string vulnerability in misc.c that can allow a remote attacker to execute arbitrary code via format specifiers in a string logged by syslog. The CVE-2004-0623 entry notes a high severity (base score 10.0, CVSS2: AV:N/AC:L/Au:N/C:C/I:C/A:C) with remote, unau...

CVE-2004-0393

CVE-2004-0393 corresponds to a format-string vulnerability in rlpr/rlprd (rlpr daemon) version 2.0.4. The flaw resides in the msg() function, where unbounded format strings provided to syslog can lead to arbitrary code execution. Documented impact is remote code execution with the rlprd process p...

CVE-2004-0393

Format string vulnerability in the msg function for rlpr daemon rlprd 2.0.4 allows remote attackers to execute arbitrary code via format string specifiers in a buffer that can not be resolved, which is provided to the syslog function...

CVE-2004-0623

Removed by vendor...

CVE-2004-0451

CVE-2004-0451 describes multiple format-string vulnerabilities in the Software Upgrade Protocol (SUP) affecting the internal logging functions logquit, logerr, and loginfo. The underlying issue allows a remote attacker to cause arbitrary code execution via format specifiers contained in syslog me...

CVE-2004-0623

Format string vulnerability in misc.c in GNU GNATS 4.00 may allow remote attackers to execute arbitrary code via format string specifiers in a string that gets logged by syslog...

CVE-2004-0451

Multiple format string vulnerabilities in the 1 logquit, 2 logerr, or 3 loginfo functions in Software Upgrade Protocol SUP allows remote attackers to execute arbitrary code via format string specifiers in messages that are logged by syslog...

GNATS format string bugs

Format string bug in syslog call...

format string vulnerability in Gnats

Zone-h Security Advisory Date of discovery : 21 june 2004 Date of release : 24 june 2004 Bug found by Khan Shirani [email protected] http://www.zone-h.org --------------------------------------- Software : GNU Gnats 4.00 Bugs : formats string bugs Risk : low/medium Platform : nix...

Rlpr 2.04 - 'msg()' Remote Format String

by jaguar !/usr/bin/python import os, sys, socket, struct, time, telnetlib class rlprd: fd = None pad = 2 00000000 31DB xor ebx,ebx 00000002 F7E3 mul ebx 00000004 B003 mov al,0x3 00000006 80C304 add bl,0x4 00000009 89E1 mov ecx,esp 0000000B 4A dec edx 0000000C CC int3 0000000D CD80 int 0x80...

Rlpr Advisory

,'| .-''-.....--'; / '. ..-' , ,--...--''' .--''' /' -';' ; ; ; ...--'' ...--..' .;.' fL ,....----''' ,..--'' felinemenace.org Program: rlprd 2.0.4 Impact: remote root Discovered: jaguar Writeup and exploits: Andrew Griffiths 1 Background It is a package that makes it possible or at the very leas...