CVE-2004-0980 Format string vulnerability in ez-ipupdate.c for ez-ipupdate 3.0.10 through 3.0.11b8, when running in daemon mode with certain service types in use, allows remote servers to execute arbitrary code.
HighCVSS 10.0
EPSS 3.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Format string vulnerability in ez-ipupdate.c for ez-ipupdate 3.0.10 through 3.0.11b8, when running in daemon mode with certain service types in use, allows remote servers to execute arbitrary code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| angus mackay ez-ipupdate | = 3.0.11b5 | No fix listed |
| angus mackay ez-ipupdate | = 3.0.11b8 | No fix listed |
| debian linux | = 3.0 | No fix listed |
| gentoo linux | All versions | No fix listed |
| debian/ez-ipupdate(Debian:11) | < 3.0.11b8-8 | 3.0.11b8-8 |
References
- 20041111 ez-ipupdate format string bug mailing-list
- 13167 third-party-advisory
- DSA-592 vendor-advisory
- GLSA-200411-20 patch vendor-advisory
- MDKSA-2004:129 vendor-advisory
- 11657 patch vdb-entry vendor-advisory
- eziupdate-showmessage-format-string(18032) vdb-entry
- security-tracker.debian.org vendor-advisory