OSVDB ID: 11390

Title: proxytunnel -a Option message() Format String

Info

Disclosure
Oct 29, 2004

Discovery
Unknown

Dates

Exploit
Oct 29, 2004

Solution
Unknown

Description

 proxytunnel contains a flaw that may allow a malicious proxy server to perform format string attacks. The issue is due to improper use of syslog() by the messages.c message() function. It is possible that the flaw may allow remote arbitrary code execution resulting in a loss of integrity.

Classification

 Location: Remote / Network Access, Local / Remote, Context Dependent
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Public
Disclosure: OSVDB Verified, Vendor Verified

Solution

 Upgrade to version 1.2.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Jos Visser and Mark Janssen

proxytunnel

 1.2.2
1.2.1
1.2.0
1.1.x

References

Credit
  • Florian Schilhabel - florian.schilhabelgmx.net -


Direct URL: http://osvdb.org/11390