Description
Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1.9.0 through 2.7 allows remote attackers to execute arbitrary code via certain GPS requests containing format string specifiers that are not properly handled in syslog calls.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gpsd | 2.7-4 | — |
| Debian 13 | gpsd | 2.7-4 | — |
| Debian 12 | gpsd | 2.7-4 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Berlios GPSD Format String Vulnerability
exploit/linux/http/gpsd_format_string
Exploit-DB 4
- Berlios GPSD - Format String (Metasploit) EDB-16853 · remote · Apr 30, 2010 · verified
- Berlios GPSD 2.7 - Remote Format String (Metasploit) EDB-3099 · remote · Jan 8, 2007 · verified
- Berlios GPSD 1.91-1 < 2.7-2 - Format String EDB-10029 · remote · May 25, 2005 · verified
- Berlios GPSD 2.7.x - Remote Format String EDB-775 · remote · Jan 26, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- [Gpsd-announce] 20050127 Announcing release 2.8 of gpsd mailing-list
- http://www.digitalmunition.com/DMA%5B2005-0125a%5D.txt
- gpsd-format-string(19079) vdb-entry
- 20050126 DMA[2005-0125a] - 'berlios gpsd format string vulnerability' mailing-list
- http://www.mail-archive.com/debian-bugs-closed%40lists.debian.org/msg02103.html