OSVDB ID: 5361

Title: sSMTP log_event Format String

Info

Disclosure
Apr 15, 2004

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 sSMTP contains a flaw that may allow a malicious user to gain the privileges of the ssmtp process. The issue is triggered when untrusted values in the functions log_event() is passed to printf-like functions as format strings. It is possible that the flaw may allow remote mail relay to gain the privileges of the ssmtp process resulting in a loss of confidentiality and/or integrity.

Classification

 Location: Local Access Required
Attack Type: Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Unknown

Solution

 Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

All Vendors

sSMTP

 2.50.x
2.60.x

References

Credit
  • Max Vozeler - maxBrand New Doo Doohinterhof.net -


Direct URL: http://osvdb.org/36218