漏洞信息详情

SSMTP邮件转送代理者多重格式化字符串漏洞

• CNNVD编号：CNNVD-200406-027
• 危害等级： 低危
  
• CVE编号： CVE-2004-0156
• 漏洞类型： 格式化字符串
• 发布时间： 2004-06-01
• 威胁类型： 远程
• 更新时间： 2005-10-20
• 厂        商： ssmtp
• 漏洞来源： Discovery is credi...

漏洞简介

ssmtp 2.50.6之前版本的（1）die或者（2）log_event函数存在格式化字符串漏洞。远程邮件继电器借助该漏洞导致服务拒绝和可能执行任意代码。

漏洞公告

OpenPKG has released an advisory (OpenPKG-SA-2004.020) to address these issues. Please see the referenced advisory for more information. Debian has released an advisory DSA 485-1 to address these issues. Please see the referenced advisory for more information. Gentoo has released an advisory to provide updates that fix this issue. These updates may be applied with the following commands: # emerge sync # emerge -pv ">=net-mail/ssmtp-2.60.7" # emerge ">=net-mail/ssmtp-2.60.7" OpenPKG OpenPKG 2.0

• OpenPKG ssmtp-2.48-2.0.1.src.rpm ftp://ftp.openpkg.org/release/2.0/UPD/ssmtp-2.48-2.0.1.src.rpm

• Debian ssmtp_2.50.6.1_alpha.debDebian GNU/Linux 3.0 (woody) http://security.debian.org/pool/updates/main/s/ssmtp/ssmtp_2.50.6.1_al pha.deb
• Debian ssmtp_2.50.6.1_arm.debDebian GNU/Linux 3.0 (woody) http://security.debian.org/pool/updates/main/s/ssmtp/ssmtp_2.50.6.1_ar m.deb
• Debian ssmtp_2.50.6.1_hppa.debDebian GNU/Linux 3.0 (woody) http://security.debian.org/pool/updates/main/s/ssmtp/ssmtp_2.50.6.1_hp pa.deb
• Debian ssmtp_2.50.6.1_i386.debDebian GNU/Linux 3.0 (woody) http://security.debian.org/pool/updates/main/s/ssmtp/ssmtp_2.50.6.1_i3 86.deb
• Debian ssmtp_2.50.6.1_ia64.debDebian GNU/Linux 3.0 (woody) http://security.debian.org/pool/updates/main/s/ssmtp/ssmtp_2.50.6.1_ia 64.deb
• Debian ssmtp_2.50.6.1_m68k.debDebian GNU/Linux 3.0 (woody) http://security.debian.org/pool/updates/main/s/ssmtp/ssmtp_2.50.6.1_m6 8k.deb
• Debian ssmtp_2.50.6.1_mips.debDebian GNU/Linux 3.0 (woody) http://security.debian.org/pool/updates/main/s/ssmtp/ssmtp_2.50.6.1_mi ps.deb
• Debian ssmtp_2.50.6.1_mipsel.debDebian GNU/Linux 3.0 (woody) http://security.debian.org/pool/updates/main/s/ssmtp/ssmtp_2.50.6.1_mi psel.deb
• Debian ssmtp_2.50.6.1_powerpc.debDebian GNU/Linux 3.0 (woody) http://security.debian.org/pool/updates/main/s/ssmtp/ssmtp_2.50.6.1_po werpc.deb
• Debian ssmtp_2.50.6.1_s390.debDebian GNU/Linux 3.0 (woody) http://security.debian.org/pool/updates/main/s/ssmtp/ssmtp_2.50.6.1_s3 90.deb
• Debian ssmtp_2.50.6.1_sparc.debDebian GNU/Linux 3.0 (woody) http://security.debian.org/pool/updates/main/s/ssmtp/ssmtp_2.50.6.1_sp arc.deb

参考网址

来源: DEBIAN 名称: DSA-485 链接:http://www.debian.org/security/2004/dsa-485 来源: GENTOO 名称: GLSA-200404-18 链接:http://security.gentoo.org/glsa/glsa-200404-18.xml 来源: XF 名称: ssmtp-die-logevent-format-string(15872) 链接:http://xforce.iss.net/xforce/xfdb/15872 来源: BID 名称: 10150 链接:http://www.securityfocus.com/bid/10150 来源: OSVDB 名称: 5361 链接:http://www.osvdb.org/5361 来源: OSVDB 名称: 5360 链接:http://www.osvdb.org/5360 来源: SECTRACK 名称: 1009788 链接:http://securitytracker.com/id?1009788 来源: SECUNIA 名称: 11571 链接:http://secunia.com/advisories/11571 来源: SECUNIA 名称: 11485 链接:http://secunia.com/advisories/11485 来源: SECUNIA 名称: 11384 链接:http://secunia.com/advisories/11384 来源: SECUNIA 名称: 11378 链接:http://secunia.com/advisories/11378 来源: BUGTRAQ 名称: 20040507 [OpenPKG-SA-2004.020] OpenPKG Security Advisory (ssmtp) 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=108403772130855&w=2

受影响实体

• Ssmtp Ssmtp:2.49  

补丁

暂无