PT-2008-2799 · Linux · Linux Kiss Server

Vashnukad · Published 2008-03-08 · Updated 2024-02-14 · CVE-2008-1206

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Linux Kiss Server version 1.2

Description The issue is related to a format string vulnerability in the log message function. This vulnerability can be exploited by remote attackers when the Linux Kiss Server is not running in background (daemon) mode. Attackers can cause a denial of service or potentially execute arbitrary code by including format string specifiers in an invalid command.

Recommendations For Linux Kiss Server version 1.2, consider disabling the log message function in lks.c or restrict access to it until a patch is available. As a temporary workaround, enable background (daemon) mode to minimize the risk of exploitation.

Exploit

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2008-1206

Affected Products

Linux Kiss Server

References · 7

• 🔥 http://vashnukad.com · Exploit
• 🔥 http://marc.info/?l=full-disclosure&m=120468901813326&w=2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1206 · Security Note
• http://secunia.com/advisories/29219 · Vendor Advisory
• http://securityfocus.com/bid/28099 · Note
• http://vupen.com/english/advisories/2008/0785 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41018 · Note