Sobexsrv Dosyslog Remote Format String Vulnerability

Bugtraq ID:	15692
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 03 2005 12:00AM
Updated:	Dec 03 2005 12:00AM
Credit:	Kevin Finisterre is credited with the discovery of this vulnerability.
Vulnerable:	sobexsrv sobexsrv 1.0 .0-pre3
Not Vulnerable:	sobexsrv sobexsrv 1.0 .0-pre4

Sobexsrv Dosyslog Remote Format String Vulnerability

sobexsrv is prone to a remote format string vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation can facilitate a crash or arbitrary code execution in the context of affected server application.

Sobexsrv Dosyslog Remote Format String Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Sobexsrv Dosyslog Remote Format String Vulnerability

Solution:
The vendor has released an update to address this issue:


sobexsrv sobexsrv 1.0 .0-pre3

• sobexsrv sobexsrv-1.0.0pre4.tar.gz
  http://www.mulliner.org/bluetooth/sobexsrv-1.0.0pre4.tar.gz

Sobexsrv Dosyslog Remote Format String Vulnerability

References:

• DMA[2005-1202a] - 'sobexsrv - Scripting/Secure OBEX Server format string vulnera (Kevin Finisterre)
  
• sobexsrv Homepage (sobexsrv)