OSVDB ID: 11004

Title: Speedtouch USB Driver Multiple Function Format String

Info

Disclosure
Sep 30, 2004

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 SpeedTouch USB modem drivers contain a flaw that may allow a malicious user to perform format string attacks. The issue is due to improper usage of syslog() by the modem_run, ppoa2, and ppoa3 functions. It is possible that the flaw may allow execution of arbitrary code, illegal address reads, or disclosure of sections of memory resulting in a loss of integrity, confidentiality and/or availability.

Classification

 Location: Local Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Unknown
Disclosure: OSVDB Verified

Solution

 Upgrade to version 1.3.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Benoit Papillaut

Thomson Multimedia SpeedTouch USB ADSL modem driver

 1.3
1.2 beta3
1.2 beta2
1.2 beta1
1.1 rc2
1.1 rc1
1.1
1.0 rc1
1.0

References

Credit
  • Max Vozeler - maxBrand New Doo Doohinterhof.net -


Direct URL: http://osvdb.org/36218