PT-2004-1508 · Gnu · Gnu Anubis

Ulf Harnhammar · Publicado 2004-03-18 · Atualizado 2017-07-11 · CVE-2004-0354

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GNU Anubis versions 3.6.0 through 3.6.2 GNU Anubis versions 3.9.92 and 3.9.93

Description The issue allows remote attackers to execute arbitrary code via format string specifiers in strings passed to certain functions. Specifically, the info function in log.c, the anubis error function in errs.c, or the ssl error function in ssl.c are vulnerable.

Recommendations For GNU Anubis versions 3.6.0 through 3.6.2, consider updating to a version outside of this range to mitigate the risk. For GNU Anubis versions 3.9.92 and 3.9.93, consider updating to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting input to the info, anubis error, and ssl error functions to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2004-0354

Produtos afetados

Gnu Anubis

Referências · 6

• 🔥 http://securityfocus.com/bid/9772 · Exploit
• 🔥 https://exploit-db.com/exploits/23771 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0354 · Nota de Segurança
• http://mail.gnu.org/archive/html/bug-anubis/2004-02/msg00000.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15346 · Nota
• http://marc.info/?l=bugtraq&m=107843915424588&w=2 · Nota