Citadel/UX SMTP Server Buffer Overflow Vulnerability
BID:4263
Info
Citadel/UX SMTP Server Buffer Overflow Vulnerability
| Bugtraq ID: | 4263 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2002-0432 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 09 2002 12:00AM |
| Updated: | Jul 11 2009 11:56AM |
| Credit: | Discovered by xperc <[email protected]>. |
| Vulnerable: |
Citadel/UX Citadel/UX 5.90 |
| Not Vulnerable: | |
Solution / Fix
Citadel/UX SMTP Server Buffer Overflow Vulnerability
Solution:
The following patch has been suggested by xperc <[email protected]>:
--- citadel-old/sysdep.c Sat Dec 8 12:31:44
2001
+++ citadel/sysdep.c Sat Mar 9 05:51:11
2002
@@ -106,7 +106,7 @@
char buf[4096];
va_start(arg_ptr, format);
- vsprintf(buf, format, arg_ptr);
+ vsnprintf(buf, sizeof(buf), format, arg_ptr);
va_end(arg_ptr);
if (loglevel <= verbosity) {
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
The following patch has been suggested by xperc <[email protected]>:
--- citadel-old/sysdep.c Sat Dec 8 12:31:44
2001
+++ citadel/sysdep.c Sat Mar 9 05:51:11
2002
@@ -106,7 +106,7 @@
char buf[4096];
va_start(arg_ptr, format);
- vsprintf(buf, format, arg_ptr);
+ vsnprintf(buf, sizeof(buf), format, arg_ptr);
va_end(arg_ptr);
if (loglevel <= verbosity) {
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.