cyan soft Multiple Applications Format String Vulnerability and Denial of Service Vulnerability
BID:27728
Info
cyan soft Multiple Applications Format String Vulnerability and Denial of Service Vulnerability
| Bugtraq ID: | 27728 |
| Class: | Unknown |
| CVE: |
CVE-2008-0756 CVE-2008-0755 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 11 2008 12:00AM |
| Updated: | Jul 06 2016 02:17PM |
| Credit: | Luigi Auriemma is credited with discovering these issues. |
| Vulnerable: |
cyan soft ltd. Opium4 OPI Server 4.10.1028 cyan soft ltd. cyanPrintIP Workstation 4.10.836 cyan soft ltd. cyanPrintIP Standard 4.10.940 cyan soft ltd. cyanPrintIP Professional 4.10.1030 cyan soft ltd. cyanPrintIP Easy OPI 4.10.1030 cyan soft ltd. cyanPrintIP Basic 4.10.1030 |
| Not Vulnerable: | |
Discussion
cyan soft Multiple Applications Format String Vulnerability and Denial of Service Vulnerability
Multiple cyan soft products are affected by a format-string vulnerability because they fail to adequately sanitize user-supplied input before passing it as the format-specifier to a formatted-printing function.
These applications are also affected by a denial-of-service vulnerability because they fail to adequately handle certain commands during the start of a connection.
Attackers can leverage these issues to execute arbitrary code in the context of the application or to terminate the application. Successful attacks will compromise the applications or deny access to legitimate users.
The following applications are affected:
Opium4 OPI Server 4.10.1028 and prior
cyanPrintIP Easy OPI 4.10.1030 and prior
cyanPrintIP Professional 4.10.1030 and prior
cyanPrintIP Workstation 4.10.836 and prior
cyanPrintIP Standard 4.10.940 and prior
cyanPrintIP Basic 4.10.1030 and prior
Multiple cyan soft products are affected by a format-string vulnerability because they fail to adequately sanitize user-supplied input before passing it as the format-specifier to a formatted-printing function.
These applications are also affected by a denial-of-service vulnerability because they fail to adequately handle certain commands during the start of a connection.
Attackers can leverage these issues to execute arbitrary code in the context of the application or to terminate the application. Successful attacks will compromise the applications or deny access to legitimate users.
The following applications are affected:
Opium4 OPI Server 4.10.1028 and prior
cyanPrintIP Easy OPI 4.10.1030 and prior
cyanPrintIP Professional 4.10.1030 and prior
cyanPrintIP Workstation 4.10.836 and prior
cyanPrintIP Standard 4.10.940 and prior
cyanPrintIP Basic 4.10.1030 and prior
Exploit / POC
cyan soft Multiple Applications Format String Vulnerability and Denial of Service Vulnerability
The following exploit code is available:
The following exploit code is available:
Solution / Fix
cyan soft Multiple Applications Format String Vulnerability and Denial of Service Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
cyan soft Multiple Applications Format String Vulnerability and Denial of Service Vulnerability
References:
References:
- Vendor Homepage (cyan soft ltd.)
- Multiple vulnerabilities in EztremeZ-IP File and Printer Server 5.1.2x15 (Luigi Auriemma
- Multiple vulnerabilities in EztremeZ-IP File and Printer Server 5.1.2x15 (Luigi Auriemma)