Description
Format string vulnerability in mmsyslog function allows remote attackers to execute arbitrary code via (1) the USER command to mmpop3d for mmmail 0.0.13 and earlier, (2) the HELO command to mmsmtpd for mmmail 0.0.13 and earlier, or (3) the USER command to mmftpd 0.0.7 and earlier.
References
- mmftpd-mmsyslog-format-string(9337) vdb-entry
- http://mmondor.gobot.ca/software/linux/mmftpd-changelog.txt
- 4990 vdb-entry
- mmmail-mmsyslog-format-string(9336) vdb-entry
- 20020612 [CERT-intexxia] mmmail POP3-SMTP Daemon Format String Vulnerability mailing-list
- 20020612 [CERT-intexxia] mmftpd FTP Daemon Format String Vulnerability mailing-list
- 4999 vdb-entry
- http://mmondor.gobot.ca/software/linux/mmmail-changelog.txt