Description
Format string vulnerability in the log function in SUS 2.0.2, and other versions before 2.0.6, allows local users to execute arbitrary code via format string specifiers in a command line argument that is passed directly to syslog.
References
- http://security.lss.hr/index.php?page=details&ID=LSS-2004-09-01
- GLSA-200409-17 vendor-advisory
- http://pdg.uow.edu.au/sus/CHANGES
- 20040914 SUS 2.0.2 local root vulnerability mailing-list
- 11176 vdb-entry
- sus-log-format-string(17361) vdb-entry