CVE-2003-0516 cnd.c in mgetty 1.1.28 and earlier does not properly filter non-printable characters and quotes, which may allow remote attackers to execute arbitrary commands via shell metacharacters in (1) caller I...
HighCVSS 7.5
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
cnd.c in mgetty 1.1.28 and earlier does not properly filter non-printable characters and quotes, which may allow remote attackers to execute arbitrary commands via shell metacharacters in (1) caller ID or (2) caller name strings.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gert doering mgetty | <= 1.1.28 | No fix listed |
| debian/mgetty(Debian:12) | < 1.1.29 | 1.1.29 |
| debian/mgetty(Debian:13) | < 1.1.29 | 1.1.29 |
| debian/mgetty(Debian:14) | < 1.1.29 | 1.1.29 |
References
- Debian Security Tracker CVE-2003-0516 vendor-advisory
- bugs.debian.org issue-tracking