CVE-2004-1097 Format string vulnerability in the cherokee_logger_ncsa_write_string function in Cherokee 0.4.17 and earlier, when authenticating via auth_pam, allows remote attackers to cause a denial of service (ap...
HighCVSS 10.0
EPSS 5.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Format string vulnerability in the cherokee_logger_ncsa_write_string function in Cherokee 0.4.17 and earlier, when authenticating via auth_pam, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via format string specifiers in the URL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cherokee httpd | = 0.1 | No fix listed |
| cherokee httpd | = 0.1.5 | No fix listed |
| cherokee httpd | = 0.1.6 | No fix listed |
| cherokee httpd | = 0.2 | No fix listed |
| cherokee httpd | = 0.2.5 | No fix listed |
| cherokee httpd | = 0.2.6 | No fix listed |
| cherokee httpd | = 0.2.7 | No fix listed |
| cherokee httpd | = 0.4.6 | No fix listed |
| cherokee httpd | = 0.4.7 | No fix listed |
| cherokee httpd | = 0.4.8 | No fix listed |
| cherokee httpd | = 0.4.17 | No fix listed |
References
- bugs.gentoo.org
- GLSA-200411-02 patch vendor-advisory
- 11574 patch vdb-entry vendor-advisory
- cherokee-format-string(17934) vdb-entry