CVE-2002-0525 Format string vulnerabilities in (1) inews or (2) rnews for INN 2.2.3 and earlier allow local users and remote malicious NNTP servers to gain privileges via format string specifiers in NTTP responses.
HighCVSS 10.0
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Format string vulnerabilities in (1) inews or (2) rnews for INN 2.2.3 and earlier allow local users and remote malicious NNTP servers to gain privileges via format string specifiers in NTTP responses.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| isc inn | = 2.0 | No fix listed |
| isc inn | = 2.1 | No fix listed |
| isc inn | = 2.2 | No fix listed |
| isc inn | = 2.2.1 | No fix listed |
| isc inn | = 2.2.2 | No fix listed |
| isc inn | = 2.2.3 | No fix listed |
References
- 20020411 Inn (Inter Net News) security problems mailing-list
- inn-rnews-inews-format-string(8834) vdb-entry vendor-advisory
- 4501 exploit patch vdb-entry vendor-advisory