rlpr Format String and Buffer Overflow Let Remote Users Execute Arbitrary Code and Local Users Gain Root Privileges
|
|
SecurityTracker Alert ID: 1010545 |
|
SecurityTracker URL: http://securitytracker.com/id/1010545
|
|
CVE Reference:
CAN-2004-0393, CAN-2004-0454
(Links to External Site)
|
Date: Jun 20 2004
|
Impact:
Execution of arbitrary code via local system, Execution of arbitrary code via network, Root access via local system, User access via network
|
|
Version(s): 2.04
|
Description:
Some vulnerabilities were reported in rlpr. A remote user can execute arbitrary code on the target system. A local user can gain root privileges.
Debian reported that jaguar@felinemenace.org discovered a format string vulnerability in rlpr in the msg() function due to a syslog(3) call made without the proper format string specifier [CVE: CAN-2004-0393].
Debian also reported that a buffer overflow was discovered in the msg() function when the above mentioned format string flaw was being investigated [CVE: CAN-2004-0454].
A remote user can execute arbitrary code with the privileges of the rlprd process. A local user can execute arbitrary code with root privileges.
|
Impact:
A remote user can execute arbitrary code with the privileges of the rlprd process.
A local user can execute arbitrary code with root privileges.
|
Solution:
No upstream solution was available at the time of this entry.
|
Vendor URL: truffula.com/rlpr/ (Links to External Site)
|
Cause:
Boundary error, Input validation error, State error
|
Underlying OS:
Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Sun, 20 Jun 2004 01:38:47 -0400
Subject: CAN-2004-0393, CAN-2004-0454
|
CVE: CAN-2004-0393, CAN-2004-0454
Debian reported that jaguar@felinemenace.org discovered a format string vulnerability in
rlpr in the msg() function due to a syslog(3) call made without the proper format string
specifier [CVE: CAN-2004-0393].
Debian also reported that a buffer overflow was discovered in the msg() function when the
above mentioned format string flaw was being investigated [CVE: CAN-2004-0454].
A remote user can execute arbitrary code with the privileges of the rlprd process. A
local user can execute arbitrary code with root privileges.
|
|
