Osiris Logging.C Format String Vulnerability
BID:19213
CVE-2006-3120 |Info
Osiris Logging.C Format String Vulnerability
| Bugtraq ID: | 19213 |
| Class: | Input Validation Error |
| CVE: |
CVE-2006-3120 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 28 2006 12:00AM |
| Updated: | Sep 19 2006 08:46PM |
| Credit: | Ulf Warhammer and Max Vozeler are credited with the discovery of this vulnerability. |
| Vulnerable: |
Shmoo Osiris 4.2 Shmoo Osiris 4.0.6 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 |
| Not Vulnerable: |
Shmoo Osiris 4.2.1 |
Discussion
Osiris Logging.C Format String Vulnerability
Osiris is prone to a format-string vulnerability because it fails to properly sanitize user-supplied input before using it in a formatted-printing function.
A successful exploit could allow an attacker to execute arbitrary code or to crash the application.
Version 4.2.0 is vulnerable to this issue; other versions may also be affected.
Osiris is prone to a format-string vulnerability because it fails to properly sanitize user-supplied input before using it in a formatted-printing function.
A successful exploit could allow an attacker to execute arbitrary code or to crash the application.
Version 4.2.0 is vulnerable to this issue; other versions may also be affected.
Exploit / POC
Osiris Logging.C Format String Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Osiris Logging.C Format String Vulnerability
Solution:
The vendor has released version 4.2.1 to address this issue. Please refer to the vendor's home page for more information.
Shmoo Osiris 4.0.6
Solution:
The vendor has released version 4.2.1 to address this issue. Please refer to the vendor's home page for more information.
Shmoo Osiris 4.0.6
-
Debian osiris_4.0.6-1sarge1_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osiris_4.0.6-1sa rge1_alpha.deb -
Debian osiris_4.0.6-1sarge1_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osiris_4.0.6-1sa rge1_amd64.deb -
Debian osiris_4.0.6-1sarge1_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osiris_4.0.6-1sa rge1_arm.deb -
Debian osiris_4.0.6-1sarge1_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osiris_4.0.6-1sa rge1_hppa.deb -
Debian osiris_4.0.6-1sarge1_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osiris_4.0.6-1sa rge1_i386.deb -
Debian osiris_4.0.6-1sarge1_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osiris_4.0.6-1sa rge1_ia64.deb -
Debian osiris_4.0.6-1sarge1_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osiris_4.0.6-1sa rge1_m68k.deb -
Debian osiris_4.0.6-1sarge1_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osiris_4.0.6-1sa rge1_mips.deb -
Debian osiris_4.0.6-1sarge1_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osiris_4.0.6-1sa rge1_mipsel.deb -
Debian osiris_4.0.6-1sarge1_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osiris_4.0.6-1sa rge1_powerpc.deb -
Debian osiris_4.0.6-1sarge1_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osiris_4.0.6-1sa rge1_s390.deb -
Debian osiris_4.0.6-1sarge1_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osiris_4.0.6-1sa rge1_sparc.deb -
Debian osirisd_4.0.6-1sarge1_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirisd_4.0.6-1s arge1_alpha.deb -
Debian osirisd_4.0.6-1sarge1_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirisd_4.0.6-1s arge1_amd64.deb -
Debian osirisd_4.0.6-1sarge1_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirisd_4.0.6-1s arge1_arm.deb -
Debian osirisd_4.0.6-1sarge1_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirisd_4.0.6-1s arge1_hppa.deb -
Debian osirisd_4.0.6-1sarge1_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirisd_4.0.6-1s arge1_i386.deb -
Debian osirisd_4.0.6-1sarge1_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirisd_4.0.6-1s arge1_ia64.deb -
Debian osirisd_4.0.6-1sarge1_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirisd_4.0.6-1s arge1_m68k.deb -
Debian osirisd_4.0.6-1sarge1_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirisd_4.0.6-1s arge1_mips.deb -
Debian osirisd_4.0.6-1sarge1_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirisd_4.0.6-1s arge1_mipsel.deb -
Debian osirisd_4.0.6-1sarge1_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirisd_4.0.6-1s arge1_powerpc.deb -
Debian osirisd_4.0.6-1sarge1_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirisd_4.0.6-1s arge1_sparc.deb -
Debian osirismd_4.0.6-1sarge1_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirismd_4.0.6-1 sarge1_alpha.deb -
Debian osirismd_4.0.6-1sarge1_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirismd_4.0.6-1 sarge1_amd64.deb -
Debian osirismd_4.0.6-1sarge1_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirismd_4.0.6-1 sarge1_arm.deb -
Debian osirismd_4.0.6-1sarge1_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirismd_4.0.6-1 sarge1_hppa.deb -
Debian osirismd_4.0.6-1sarge1_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirismd_4.0.6-1 sarge1_i386.deb -
Debian osirismd_4.0.6-1sarge1_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirismd_4.0.6-1 sarge1_ia64.deb -
Debian osirismd_4.0.6-1sarge1_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirismd_4.0.6-1 sarge1_m68k.deb -
Debian osirismd_4.0.6-1sarge1_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirismd_4.0.6-1 sarge1_mips.deb -
Debian osirismd_4.0.6-1sarge1_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirismd_4.0.6-1 sarge1_mipsel.deb -
Debian osirismd_4.0.6-1sarge1_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirismd_4.0.6-1 sarge1_powerpc.deb -
Debian osirismd_4.0.6-1sarge1_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirismd_4.0.6-1 sarge1_s390.deb -
Debian osirismd_4.0.6-1sarge1_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/o/osiris/osirismd_4.0.6-1 sarge1_sparc.deb
References
Osiris Logging.C Format String Vulnerability
References:
References: