Unscored severity · published Oct 4, 2002
CVE-2002-0925
Format string vulnerability in mmsyslog function allows remote attackers to execute arbitrary code via (1) the USER command to mmpop3d for mmmail 0.0.13 and earlier, (2) the HELO…
–
CVSS
3.4%
EPSS
No
On KEV
Description
Format string vulnerability in mmsyslog function allows remote attackers to execute arbitrary code via (1) the USER command to mmpop3d for mmmail 0.0.13 and earlier, (2) the HELO command to mmsmtpd for mmmail 0.0.13 and earlier, or (3) the USER command to mmftpd 0.0.7 and earlier.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.4% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MM
Mmftpd · Matthew Mondor
through 0.0.7 · source: NVD
MM
Mmmail · Matthew Mondor
through 0.0.13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-0925
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-0925
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2002-06/0095.html
mmondor.gobot.ca
http://mmondor.gobot.ca/software/linux/mmftpd-changelog.txt
mmondor.gobot.ca
http://mmondor.gobot.ca/software/linux/mmmail-changelog.txt
online.securityfocus.com
http://online.securityfocus.com/archive/1/276523
Patch
http://www.iss.net/security_center/static/9336.php
Patch
http://www.iss.net/security_center/static/9337.php