CVE-2004-2386 Format string vulnerability in the LogMsg function in sercd before 2.3.1 and sredird 2.2.1 and earlier allows remote attackers to execute arbitrary code via format string specifiers passed from the Ha...
HighCVSS 7.5
EPSS 3.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Format string vulnerability in the LogMsg function in sercd before 2.3.1 and sredird 2.2.1 and earlier allows remote attackers to execute arbitrary code via format string specifiers passed from the HandleCPCCommand function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| denis sbragion sredird | = 1.0 | No fix listed |
| denis sbragion sredird | = 1.1.6 | No fix listed |
| denis sbragion sredird | = 1.1.7 | No fix listed |
| denis sbragion sredird | = 1.1.8 | No fix listed |
| denis sbragion sredird | = 2.0 | No fix listed |
| denis sbragion sredird | = 2.1 | No fix listed |
| denis sbragion sredird | = 2.2 | No fix listed |
| denis sbragion sredird | = 2.2.1 | No fix listed |
| peter astrand sercd | = 2.3.0 | No fix listed |
| debian/sredird(Debian:12) | < 2.2.1-1.1 | 2.2.1-1.1 |
| debian/sredird(Debian:13) | < 2.2.1-1.1 | 2.2.1-1.1 |
| debian/sredird(Debian:14) | < 2.2.1-1.1 | 2.2.1-1.1 |
References
- cvs.lysator.liu.se
- 12351 third-party-advisory vendor-advisory
- 1011038 vdb-entry
- 8375 patch vdb-entry
- 9104 vdb-entry
- 11002 vdb-entry
- 11031 patch vdb-entry
- sredird-logmsg-format-string(17056) vdb-entry
- Debian Security Tracker CVE-2004-2386 vendor-advisory
- bugs.debian.org issue-tracking