Vulnerabilities > CVE-2004-0156 - Format String vulnerability in SSMTP Mail Transfer Agent

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
ssmtp
nessus
NVD
Published: 2004-06-01
Updated: 2017-07-11

Summary

Format string vulnerabilities in the (1) die or (2) log_event functions for ssmtp before 2.50.6 allow remote mail relays to cause a denial of service and possibly execute arbitrary code.

Vulnerable Configurations

Part Description Count
Application
Ssmtp
1

Nessus

  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200404-18.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200404-18 (Multiple Vulnerabilities in ssmtp) There are two format string vulnerabilities inside the log_event() and die() functions of ssmtp. Strings from outside ssmtp are passed to various printf()-like functions from within log_event() and die() as format strings. An attacker could cause a specially crafted string to be passed to these functions, and potentially cause ssmtp to execute arbitrary code. Impact : If ssmtp connects to a malicious mail relay server, this vulnerability can be used to execute code with the rights of the mail sender, including root. Workaround : There is no known workaround at this time. All users are advised to upgrade to the latest available version of ssmtp.
    last seen2020-06-01
    modified2020-06-02
    plugin id14483
    published2004-08-30
    reporterThis script is Copyright (C) 2004-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/14483
    titleGLSA-200404-18 : Multiple Vulnerabilities in ssmtp
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-485.NASL
    descriptionMax Vozeler discovered two format string vulnerabilities in ssmtp, a simple mail transport agent. Untrusted values in the functions die() and log_event() were passed to printf-like functions as format strings. These vulnerabilities could potentially be exploited by a remote mail relay to gain the privileges of the ssmtp process (including potentially root).
    last seen2020-06-01
    modified2020-06-02
    plugin id15322
    published2004-09-29
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/15322
    titleDebian DSA-485-1 : ssmtp - format string

References