Executive Summary
| Summary | |
|---|---|
| Title | New log2mail packages fix format string vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | DSA-513 | First vendor Publication | 2004-06-03 |
| Vendor | Debian | Last vendor Modification | 2004-06-03 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| jaguar@felinemenace.org discovered a format string vulnerability in log2mail, whereby a user able to log a specially crafted message to a logfile monitored by log2mail (for example, via syslog) could cause arbitrary code to be executed with the privileges of the log2mail process. By default, this process runs as user 'log2mail', which is a member of group 'adm' (which has access to read system logfiles). CAN-2004-0450: log2mail format string vulnerability via syslog(3) in printlog() For the current stable distribution (woody), this problem has been fixed in version 0.2.5.2. For the unstable distribution (sid), this problem will be fixed soon. We recommend that you update your log2mail package. |
Original Source
| Url : http://www.debian.org/security/2004/dsa-513 |
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 4 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-01-17 | Name : Debian Security Advisory DSA 513-1 (log2mail) File : nvt/deb_513_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 6711 | log2mail printlog() Message Logging Format String log2mail contains a flaw that may allow a malicious user to execute arbitrary code on the system. This issue is due to a format string error in the "printlog()" function. By logging a crafted message via the syslog function, a local attacker can execute arbitrary code with the privilege of the log2mail process, which is typically a member of group 'adm', resulting in a loss of integrity. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-513.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:33:20 |
|
