PT-2004-1508 · Gnu · Gnu Anubis

Ulf Harnhammar · Published 2004-03-18 · Updated 2017-07-11 · CVE-2004-0354

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GNU Anubis versions 3.6.0 through 3.6.2 GNU Anubis versions 3.9.92 and 3.9.93

Description The issue allows remote attackers to execute arbitrary code via format string specifiers in strings passed to certain functions. Specifically, the info function in log.c, the anubis error function in errs.c, or the ssl error function in ssl.c are vulnerable.

Recommendations For GNU Anubis versions 3.6.0 through 3.6.2, consider updating to a version outside of this range to mitigate the risk. For GNU Anubis versions 3.9.92 and 3.9.93, consider updating to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting input to the info, anubis error, and ssl error functions to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2004-0354

Affected Products

Gnu Anubis

References · 6

• 🔥 http://securityfocus.com/bid/9772 · Exploit
• 🔥 https://exploit-db.com/exploits/23771 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0354 · Security Note
• http://mail.gnu.org/archive/html/bug-anubis/2004-02/msg00000.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15346 · Note
• http://marc.info/?l=bugtraq&m=107843915424588&w=2 · Note