CVE-2002-0916 Format string vulnerability in the allowuser code for the Stellar-X msntauth authentication module, as distributed in Squid 2.4.STABLE6 and earlier, allows remote attackers to execute arbitrary code v...
HighCVSS 7.5
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Format string vulnerability in the allowuser code for the Stellar-X msntauth authentication module, as distributed in Squid 2.4.STABLE6 and earlier, allows remote attackers to execute arbitrary code via format strings in the user name, which are not properly handled in a syslog call.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| stellar-x software msntauth | <= 2.0.3 | No fix listed |
| debian/squid(Debian:12) | < 2.4.7 | 2.4.7 |
| debian/squid(Debian:13) | < 2.4.7 | 2.4.7 |
| debian/squid(Debian:14) | < 2.4.7 | 2.4.7 |
References
- 20020603 [VulnWatch] [DER #11] - Remotey exploitable fmt string bug in squid mailing-list
- 20020604 [DER #11] - Remotey exploitable fmt string bug in squid mailing-list
- msntauth-squid-format-string(9248) vdb-entry vendor-advisory
- 4929 vdb-entry vendor-advisory
- www.squid-cache.org
- Debian Security Tracker CVE-2002-0916 vendor-advisory