PT-2006-6469 · Elog · Elog

Ulf Harnhammar · Published 2006-11-07 · Updated 2017-07-20 · CVE-2006-5790

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: ELOG versions 2.6.2 and earlier

Description: The issue concerns multiple format string vulnerabilities in the elogd.c file. These vulnerabilities can be exploited by remote attackers to cause a denial of service (crash) and possibly execute arbitrary code. The vulnerabilities can be triggered through an entry with an attachment whose name contains format string specifiers in the el submit function, as well as potentially other vectors in the receive config, show rss feed, show elog list, show logbook node, and server loop functions.

Recommendations: For ELOG versions 2.6.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-5790

DSA-1242-1

Affected Products

Elog

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2006-5790 · Security Note
• http://secunia.com/advisories/22638 · Vendor Advisory
• http://debian.org/security/2006/dsa-1242 · Vendor Advisory
• http://vupen.com/english/advisories/2006/4315 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=392016 · Note
• http://securityfocus.com/bid/20876 · Note
• http://secunia.com/advisories/23580 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29987 · Note