Posadis DNS Server Logging Format String Vulnerability

Bugtraq ID:	4378
Class:	Input Validation Error
CVE:
Remote:	Unknown
Local:	Yes
Published:	Mar 27 2002 12:00AM
Updated:	Mar 27 2002 12:00AM
Credit:	Discovered by kkr <[email protected]>.
Vulnerable:	Posadis Posadis m5pre1
Not Vulnerable:	Posadis Posadis m5pre2

Posadis DNS Server Logging Format String Vulnerability

Posadis is an open source implementation of a non caching DNS server. It is designed to be easy to use and configure. Posadis is available for Windows, Linux and many common Unix-like systems.

The logging function used by Posadis suffers from a format string vulnerability. Exploitation may result in a denial of service condition, or in the execution of arbitrary code. Remote exploitation has not been demonstrated, but may be possible.

Posadis DNS Server Logging Format String Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Posadis DNS Server Logging Format String Vulnerability

Solution:
An updated version is available:


Posadis Posadis m5pre1

• Posadis posadis-m5pre2.exe
  http://prdownloads.sourceforge.net/posadis/posadis-m5pre2.exe


• Posadis posadis-m5pre2.tar.gz
  http://prdownloads.sourceforge.net/posadis/posadis-m5pre2.tar.gz

Posadis DNS Server Logging Format String Vulnerability

References:

• Posadis Homepage (Posadis)