PT-2004-3462 · Enderunix · Isoqlog

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2571

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions EnderUNIX isoqlog version 2.1.1

Description The issue allows remote and local attackers to execute arbitrary code due to multiple buffer overflows in various functions. These functions include parseQmailFromBytesLine, parseQmailToRemoteLine, parseQmailToLocalLine, parseSendmailFromBytesLine, parseSendmailToLine, parseEximFromBytesLine, and parseEximToLine in Parser.c. Local users can also execute arbitrary code via the lowercase and check syslog date functions in Parser.c, and unspecified functions in Dir.c. Additionally, unspecified attackers can execute arbitrary code via the loadconfig and removespaces functions in loadconfig.c, the loadLang function in LangCfg.c, and unspecified functions in Html.c.

Recommendations For EnderUNIX isoqlog version 2.1.1, consider disabling the affected functions, including parseQmailFromBytesLine, parseQmailToRemoteLine, parseQmailToLocalLine, parseSendmailFromBytesLine, parseSendmailToLine, parseEximFromBytesLine, parseEximToLine, lowercase, check syslog date, loadconfig, removespaces, and loadLang, until a patch is available. Restrict access to the vulnerable modules, such as Parser.c, Dir.c, loadconfig.c, LangCfg.c, and Html.c, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-2571

Affected Products

Isoqlog

References · 9

• https://osv.dev/vulnerability/CVE-2004-2571 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-2571 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-2571 · Vendor Advisory
• http://securitytracker.com/id?1010292 · Patch
• http://secunia.com/advisories/11741 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2571 · Security Note
• http://securityfocus.com/bid/10433 · Patch
• http://archives.neohapsis.com/archives/bugtraq/2004-05/0298.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16308 · Note