PT-2005-3322 · Nbsmtp · Nbsmtp

Published 2005-08-01 · Updated 2017-07-11 · CVE-2005-2409

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions nbsmtp versions 0.99 and earlier

Description The issue is related to a format string vulnerability in the util.c file of nbsmtp, which occurs when the software is running in debug mode. This vulnerability allows remote attackers to execute arbitrary code by using format string specifiers that are not properly handled in a syslog call.

Recommendations For nbsmtp versions 0.99 and earlier, consider disabling the debug mode as a temporary workaround until a patch is available. Restrict access to the vulnerable util.c module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2005-2409

Affected Products

Nbsmtp

References · 8

• 🔥 https://exploit-db.com/exploits/1138 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2409 · Security Note
• http://people.freebsd.org/~niels/issues/nbsmtp-20050726.txt · Patch
• http://secunia.com/advisories/16324 · Note
• http://secunia.com/advisories/16279 · Note
• http://securityfocus.com/bid/14441 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21674 · Note
• http://vuxml.org/freebsd/debbb39c-fdb3-11d9-a30d-00b0d09acbfc.html · Note