mirror/freebsd-ports
1
0
Fork 0
mirror of https://git.FreeBSD.org/ports.git synced 2025-01-20 08:27:15 +00:00
Code Issues Releases Activity

Fix a format string vulnerability in ez-ipupdate.

Browse Source 
Approved by:	se@
Obtained from:	Ulf Harnhammar <Ulf.Harnhammar.9485@student.uu.se>
This commit is contained in:
Christian Weisgerber 2004-11-11 15:46:04 +00:00
parent ee9c5a399c
commit 9df9abd00d
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=121386
3 changed files with 42 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
dns/ez-ipupdate/Makefile
View File

@ -7,7 +7,7 @@
PORTNAME= ez-ipupdate
PORTVERSION= 3.0.11b8
PORTREVISION= 1
PORTREVISION= 2
CATEGORIES= dns
MASTER_SITES= http://www.gusnet.cx:8080/proj/ez-ipupdate/dist/

14
dns/ez-ipupdate/files/patch-ez-ipupdate.c Normal file
View File

@ -0,0 +1,14 @@
$FreeBSD$
--- ez-ipupdate.c.orig
+++ ez-ipupdate.c
@@ -798,7 +798,7 @@
sprintf(buf, "message incomplete because your OS sucks: %s\n", fmt);
#endif
- syslog(LOG_NOTICE, buf);
+ syslog(LOG_NOTICE, "%s", buf);
}
else
{

27
security/vuxml/vuln.xml
View File

@ -32,6 +32,33 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
<vuln vid="e69ba632-326f-11d9-b5b7-000854d03344">
<topic>ez-ipupdate -- format string vulnerability</topic>
<affects>
<package>
<name>ez-ipupdate</name>
<range><lt>3.0.11b8_2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Data supplied by a remote server is used as the format string
instead of as parameters in a syslog() call. This may lead
to crashes or potential running of arbitrary code. It is
only a problem when running in daemon mode (very common) and
when using some service types.</p>
</body>
</description>
<references>
<cvename>CAN-2004-0980</cvename>
<mlist>http://lists.netsys.com/pipermail/full-disclosure/2004-November/028590.html</mlist>
</references>
<dates>
<discovery>2004-11-11</discovery>
<entry>2004-11-11</entry>
</dates>
</vuln>
<vuln vid="eeb1c128-33e7-11d9-a9e7-0001020eed82">
<topic>ImageMagick -- EXIF parser buffer overflow</topic>
<affects>