CVE-2004-2026 Format string vulnerability in the logmsg function in svc.c for Pound 1.5 and earlier allows remote attackers to execute arbitrary code via format string specifiers in syslog messages.
HighCVSS 7.5
EPSS 6.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Format string vulnerability in the logmsg function in svc.c for Pound 1.5 and earlier allows remote attackers to execute arbitrary code via format string specifiers in syslog messages.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apsis pound | = 1.0 | No fix listed |
| apsis pound | = 1.1 | No fix listed |
| apsis pound | = 1.2 | No fix listed |
| apsis pound | = 1.3 | No fix listed |
| apsis pound | = 1.4 | No fix listed |
| apsis pound | = 1.5 | No fix listed |
| debian/pound(Debian:13) | < 1.7-1 | 1.7-1 |
| debian/pound(Debian:14) | < 1.7-1 | 1.7-1 |
References
- Debian Security Tracker CVE-2004-2026 vendor-advisory
- 20040507 Pound <=1.5 Remote Exploit (Format string bug) exploit mailing-list
- 11528 patch third-party-advisory
- GLSA-200405-08 patch vendor-advisory
- 1010034 vdb-entry
- www.apsis.ch
- 5746 vdb-entry
- 10267 exploit patch vdb-entry
- pound-logmsg-format-string(16033) vdb-entry