CVE-2005-1127 Format string vulnerability in the log function in Net::Server 0.87 and earlier, as used in Postfix Greylisting Policy Server (Postgrey) 1.18 and earlier, and possibly other products, allows remote at...
MediumCVSS 5.0
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Format string vulnerability in the log function in Net::Server 0.87 and earlier, as used in Postfix Greylisting Policy Server (Postgrey) 1.18 and earlier, and possibly other products, allows remote attackers to cause a denial of service (crash) via format string specifiers that are not properly handled before being sent to syslog, as demonstrated using sender addresses to Postgrey.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| postgrey | <= 1.16 | No fix listed |
| postgrey | = 1.17 | No fix listed |
| postgrey | = 1.18 | No fix listed |
| debian/libnet-server-perl(Debian:12) | < 0.89-1 | 0.89-1 |
| debian/libnet-server-perl(Debian:13) | < 0.89-1 | 0.89-1 |
| debian/libnet-server-perl(Debian:14) | < 0.89-1 | 0.89-1 |
| debian/postgrey(Debian:12) | < 1.22-1 | 1.22-1 |
| debian/postgrey(Debian:13) | < 1.22-1 | 1.22-1 |
| debian/postgrey(Debian:14) | < 1.22-1 | 1.22-1 |
References
- [postgrey] 20050414 Problem with crashing postgrey mailing-list
- [postgrey] 20050414 Re: Problem with crashing postgrey mailing-list
- [postgrey] 20050414 ANNOUNCE: Postgrey 1.21 (SECURITY) mailing-list patch
- 20050415 Use of function "log" in Perl module Net::Server mailing-list
- 14958 patch third-party-advisory
- 21149 third-party-advisory
- 21152 third-party-advisory
- 21164 third-party-advisory
- 21452 third-party-advisory
- DSA-1121 vendor-advisory
- DSA-1122 vendor-advisory
- GLSA-200608-18 vendor-advisory
- MDKSA-2006:131 vendor-advisory
- 15517 vdb-entry
- 13193 vdb-entry
- postgrey-logging-dos(20108) vdb-entry
- Debian Security Tracker CVE-2005-1127 vendor-advisory
- bugs.debian.org issue-tracking