CVE-2004-0393 Format string vulnerability in the msg function for rlpr daemon (rlprd) 2.0.4 allows remote attackers to execute arbitrary code via format string specifiers in a buffer that can not be resolved, which...
HighCVSS 10.0
EPSS 17.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Format string vulnerability in the msg function for rlpr daemon (rlprd) 2.0.4 allows remote attackers to execute arbitrary code via format string specifiers in a buffer that can not be resolved, which is provided to the syslog function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rlpr | = 2.0 | No fix listed |
| rlpr | = 2.0.1 | No fix listed |
| rlpr | = 2.0.2 | No fix listed |
| rlpr | = 2.0.3 | No fix listed |
| rlpr | = 2.0.4 | No fix listed |
| debian/rlpr(Debian:12) | < 2.02-7.1 | 2.02-7.1 |
| debian/rlpr(Debian:13) | < 2.02-7.1 | 2.02-7.1 |
| debian/rlpr(Debian:14) | < 2.02-7.1 | 2.02-7.1 |
References
- Debian Security Tracker CVE-2004-0393 vendor-advisory
- bugs.debian.org issue-tracking
- 20040624 Rlpr Advisory mailing-list
- DSA-524 patch vendor-advisory
- 10578 exploit patch vdb-entry vendor-advisory
- rlpr-msg-format-string(16453) vdb-entry