FreeBSD : nbsmtp -- format string vulnerability (debbb39c-fdb3-11d9-a30d-00b0d09acbfc)

High Nessus Plugin ID 19357


The remote FreeBSD host is missing a security-related update.


When nbsmtp is executed in debug mode, server messages will be printed to stdout and logged via syslog. Syslog is used insecurely and user-supplied format characters are directly fed to the syslog function, which results in a format string vulnerability.

Under some circumstances, an SMTP server may be able to abuse this vulnerability in order to alter the nbsmtp process and execute malicious code.


Update the affected package.

See Also

Plugin Details

Severity: High

ID: 19357

File Name: freebsd_pkg_debbb39cfdb311d9a30d00b0d09acbfc.nasl

Version: $Revision: 1.10 $

Type: local

Published: 2005/08/01

Modified: 2013/06/22

Dependencies: 12634

Risk Information

Risk Factor: High

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:nbsmtp, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2005/08/01

Vulnerability Publication Date: 2005/07/25