Vulnerabilities > CVE-2005-2658 - Remote Buffer Overflow vulnerability in Softwolves Software Turquoise Superstat 2.2.4

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
softwolves-software
nessus
NVD
Published: 2005-09-15
Updated: 2008-09-05

Summary

Buffer overflow in utility.cpp in Turquoise SuperStat (turqstat) 2.2.4 and earlier might allow remote NNTP servers to execute arbitrary code via a date with a long month.

Vulnerable Configurations

Part Description Count
Application
Softwolves_Software
2

Nessus

NASL familyDebian Local Security Checks
NASL idDEBIAN_DSA-812.NASL
descriptionPeter Karlsson discovered a buffer overflow in Turquoise SuperStat, a program for gathering statistics from Fidonet and Usenet, that can be exploited by a specially crafted NNTP server.
last seen2020-06-01
modified2020-06-02
plugin id19708
published2005-09-17
reporterThis script is Copyright (C) 2005-2019 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/19708
titleDebian DSA-812-1 : turqstat - buffer overflow
code
#%NASL_MIN_LEVEL 80502

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-812. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(19708);
  script_version("1.17");
  script_cvs_date("Date: 2019/08/02 13:32:19");

  script_cve_id("CVE-2005-2658");
  script_xref(name:"DSA", value:"812");

  script_name(english:"Debian DSA-812-1 : turqstat - buffer overflow");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Peter Karlsson discovered a buffer overflow in Turquoise SuperStat, a
program for gathering statistics from Fidonet and Usenet, that can be
exploited by a specially crafted NNTP server."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.debian.org/security/2005/dsa-812"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the turqstat package.

For the old stable distribution (woody) this problem has been fixed in
version 2.2.1woody1.

For the stable distribution (sarge) this problem has been fixed in
version 2.2.2sarge1."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:turqstat");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:3.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:3.1");

  script_set_attribute(attribute:"patch_publication_date", value:"2005/09/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2005/09/17");
  script_set_attribute(attribute:"vuln_publication_date", value:"2005/09/15");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"3.0", prefix:"turqstat", reference:"2.2.1woody1")) flag++;
if (deb_check(release:"3.0", prefix:"xturqstat", reference:"2.2.1woody1")) flag++;
if (deb_check(release:"3.1", prefix:"turqstat", reference:"2.2.2sarge1")) flag++;
if (deb_check(release:"3.1", prefix:"xturqstat", reference:"2.2.2sarge1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

References