CVE-2004-0640 Format string vulnerability in the SSL_set_verify function in telnetd.c for SSLtelnet daemon (SSLtelnetd) 0.13 allows remote attackers to execute arbitrary code.
HighCVSS 10.0
EPSS 4.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Format string vulnerability in the SSL_set_verify function in telnetd.c for SSLtelnet daemon (SSLtelnetd) 0.13 allows remote attackers to execute arbitrary code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netkit linux netkit | = 0.17 | No fix listed |
| netkit linux netkit | = 0.17.17 | No fix listed |
| ssltelnetd secure telnet | = 0.13.1 | No fix listed |
| debian/netkit-telnet-ssl(Debian:12) | < 0.17.24+0.1-2 | 0.17.24+0.1-2 |
| debian/netkit-telnet-ssl(Debian:13) | < 0.17.24+0.1-2 | 0.17.24+0.1-2 |
| debian/netkit-telnet-ssl(Debian:14) | < 0.17.24+0.1-2 | 0.17.24+0.1-2 |
References
- DSA-529 patch vendor-advisory
- www.idefense.com
- ssltelnetd-format-string(16653) vdb-entry
- Debian Security Tracker CVE-2004-0640 vendor-advisory