FreeBSD : nbsmtp -- format string vulnerability (debbb39c-fdb3-11d9-a30d-00b0d09acbfc)

high Nessus Plugin ID 19357

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

When nbsmtp is executed in debug mode, server messages will be printed to stdout and logged via syslog. Syslog is used insecurely and user-supplied format characters are directly fed to the syslog function, which results in a format string vulnerability.

Under some circumstances, an SMTP server may be able to abuse this vulnerability in order to alter the nbsmtp process and execute malicious code.

Solution

Update the affected package.

Plugin Details

Severity: High

ID: 19357

File Name: freebsd_pkg_debbb39cfdb311d9a30d00b0d09acbfc.nasl

Version: 1.14

Type: local

Family: FreeBSD Local Security Checks

Published: 8/1/2005

Updated: 1/6/2021

Supported Sensors: Nessus

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:nbsmtp, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 8/1/2005

Vulnerability Publication Date: 7/25/2005

Detections

Analytics