Format string vulnerability in the log function in Net::Server 0.87 and earlier, as used in Postfix Greylisting Policy Server (Postgrey) 1.18 and earlier, and possibly other products, allows remote attackers to cause a denial of service (crash) via format string specifiers that are not properly handled before being sent to syslog, as demonstrated using sender addresses to Postgrey.

A format string problem was found in the logging routines of the perl-Net-Server perl module collection. This could lead to a remote attacker being able to crash a server using the perl-Net-Server module.

This is tracked by the Mitre CVE ID CVE-2005-1127.

Peter Bieringer discovered that the 'log' function in the Net::Server Perl module, an extensible, general perl server engine, is not safe against format string exploits.

Peter Bieringer discovered that postgrey, a greylisting implementation for Postfix, is vulnerable to a format string attack that allows remote attackers to cause a denial of service to the daemon.

The remote host is affected by the vulnerability described in GLSA-200608-18 (Net::Server: Format string vulnerability)

    The log function of Net::Server does not handle format string     specifiers properly before they are sent to syslog.
  Impact :

    By sending a specially crafted datastream to an application using     Net::Server, an attacker could cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
41076	SuSE9 Security Update : perl-Net-Server (YOU Patch Number 10270)	Nessus	SuSE Local Security Checks	medium
22664	Debian DSA-1122-1 : libnet-server-perl - format string	Nessus	Debian Local Security Checks	medium
22663	Debian DSA-1121-1 : postgrey - format string	Nessus	Debian Local Security Checks	medium
22217	GLSA-200608-18 : Net::Server: Format string vulnerability	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2005-1127

high

Tenable Plugins

medium

medium

medium

medium