Kim Storm NN NNTP Error Message Format String Vulnerability
BID:5160
Info
Kim Storm NN NNTP Error Message Format String Vulnerability
| Bugtraq ID: | 5160 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 04 2002 12:00AM |
| Updated: | Jul 04 2002 12:00AM |
| Credit: | Discovery credited to zillion <[email protected]>. |
| Vulnerable: |
Kim Storm nn 6.6.3 Kim Storm nn 6.6.2 Kim Storm nn 6.6.1 Kim Storm nn 6.6 .0 |
| Not Vulnerable: |
Kim Storm nn 6.6.4 |
Discussion
Kim Storm NN NNTP Error Message Format String Vulnerability
Kim Storm nn is a menu based NNTP (Net News Transfer Protocol) news reader designed for use with Unix and Linux variant operating environments.
It has been reported that versions 6.6.3 and earlier of nn are vulnerable to a remote format string vulnerability. This may be exploited by remote attackers to potentially execute arbitrary instructions with the privileges of the nn process.
The vulnerability is a result of nn displaying error messages on the vulnerable system without proper checks. The vulnerability occurs in the nn_exitmsg() function.
Kim Storm nn is a menu based NNTP (Net News Transfer Protocol) news reader designed for use with Unix and Linux variant operating environments.
It has been reported that versions 6.6.3 and earlier of nn are vulnerable to a remote format string vulnerability. This may be exploited by remote attackers to potentially execute arbitrary instructions with the privileges of the nn process.
The vulnerability is a result of nn displaying error messages on the vulnerable system without proper checks. The vulnerability occurs in the nn_exitmsg() function.
Exploit / POC
Kim Storm NN NNTP Error Message Format String Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Kim Storm NN NNTP Error Message Format String Vulnerability
Solution:
The vendor has released an upgraded version of nn.
Kim Storm nn 6.6 .0
Kim Storm nn 6.6.1
Kim Storm nn 6.6.2
Kim Storm nn 6.6.3
Solution:
The vendor has released an upgraded version of nn.
Kim Storm nn 6.6 .0
-
Kim Storm nn-6.6.4.tar.Z
ftp://ftp.nndev.org/pub/nn-6.6/nn-6.6.4.tar.Z
Kim Storm nn 6.6.1
-
Kim Storm nn-6.6.4.tar.Z
ftp://ftp.nndev.org/pub/nn-6.6/nn-6.6.4.tar.Z
Kim Storm nn 6.6.2
-
Kim Storm nn-6.6.4.tar.Z
ftp://ftp.nndev.org/pub/nn-6.6/nn-6.6.4.tar.Z
Kim Storm nn 6.6.3
-
Kim Storm nn-6.6.4.tar.Z
ftp://ftp.nndev.org/pub/nn-6.6/nn-6.6.4.tar.Z