PT-2002-1485 · Citadel · Citadel/Ux

Published 2002-06-11 · Updated 2008-09-05 · CVE-2002-0432

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Citadel/UX versions 5.90 and earlier

Description The issue is related to buffer overflow in the lprintf and cprintf functions within the sysdep.c file. This can be exploited by remote attackers through specific attacks, such as a long HELO command to the SMTP server, potentially leading to a denial of service or the execution of arbitrary code.

Recommendations For Citadel/UX versions 5.90 and earlier, consider restricting access to the SMTP server to minimize the risk of exploitation until a patch is available. As a temporary workaround, limiting the length of the HELO command could help mitigate the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-0432

Affected Products

Citadel/Ux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2002-0432 · Security Note
• http://securityfocus.com/bid/4263 · Vendor Advisory
• http://online.securityfocus.com/archive/1/260934 · Vendor Advisory
• http://iss.net/security_center/static/8426.php · Vendor Advisory
• http://uncensored.citadel.org/pub/citadel/citadel-ux-5.91.tar.gz · Note