Debian DSA-085-1 : nvi - Format string vulnerability

high Nessus Plugin ID 14922

Synopsis

The remote Debian host is missing a security-related update.

Description

Takeshi Uno found a very stupid format string vulnerability in all versions of nvi (in both, the plain and the multilingualized version). When a filename is saved, it ought to get displayed on the screen. The routine handling this didn't escape format strings.

Solution

This problem has been fixed in version 1.79-16a.1 for nvi and 1.79+19991117-2.3 for nvi-m17n for the stable Debian GNU/Linux 2.2.

Even if we don't believe that this could lead into somebody gaining access of another users account if they haven't lost their brain, we recommend that you upgrade your nvi packages.

See Also

http://www.debian.org/security/2001/dsa-085

Plugin Details

Severity: High

ID: 14922

File Name: debian_DSA-085.nasl

Version: 1.19

Type: local

Agent: unix

Published: 9/29/2004

Updated: 1/4/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:nvi, p-cpe:/a:debian:debian_linux:nvi-m17n, cpe:/o:debian:debian_linux:2.2

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 10/20/2001

Vulnerability Publication Date: 10/20/2001

Reference Information

CVE: CVE-2001-1562

DSA: 085