PT-2004-1577 · Unknown · Software Upgrade Protocol

Published 2004-06-30 · Updated 2017-07-11 · CVE-2004-0451

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Software Upgrade Protocol (SUP) (affected versions not specified)

Description The issue concerns multiple format string vulnerabilities in the logquit, logerr, or loginfo functions. These vulnerabilities allow remote attackers to execute arbitrary code via format string specifiers in messages that are logged by syslog.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-0451

DSA-521

Affected Products

Software Upgrade Protocol

References · 8

• http://debian.org/security/2004/dsa-521 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0451 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-0451 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0451 · Security Note
• http://securityfocus.com/bid/10571 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0451 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16459 · Note
• http://securitytracker.com/id?1010539 · Note