CVE-2004-0451 Multiple format string vulnerabilities in the (1) logquit, (2) logerr, or (3) loginfo functions in Software Upgrade Protocol (SUP) allows remote attackers to execute arbitrary code via format string s...
HighCVSS 10.0
EPSS 4.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple format string vulnerabilities in the (1) logquit, (2) logerr, or (3) loginfo functions in Software Upgrade Protocol (SUP) allows remote attackers to execute arbitrary code via format string specifiers in messages that are logged by syslog.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sup | = 1.8 | No fix listed |
| debian linux | = 3.0 | No fix listed |
| debian/sup(Debian:12) | < 1.8-11 | 1.8-11 |
| debian/sup(Debian:13) | < 1.8-11 | 1.8-11 |
| debian/sup(Debian:14) | < 1.8-11 | 1.8-11 |
References
- 1010539 vdb-entry
- DSA-521 patch vendor-advisory
- 10571 patch vdb-entry vendor-advisory
- sup-format-string(16459) vdb-entry
- Debian Security Tracker CVE-2004-0451 vendor-advisory