Unscored severity · published Dec 31, 2004
CVE-2004-2386
Format string vulnerability in the LogMsg function in sercd before 2.3.1 and sredird 2.2.1 and earlier allows remote attackers to execute arbitrary code via format string…
–
CVSS
3.2%
EPSS
No
On KEV
Description
Format string vulnerability in the LogMsg function in sercd before 2.3.1 and sredird 2.2.1 and earlier allows remote attackers to execute arbitrary code via format string specifiers passed from the HandleCPCCommand function.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Sercd · Peter Astrand
2.3.0 · source: NVD
SR
Sredird · Denis Sbragion
1.0; 1.1.6; 1.1.7; 1.1.8; 2.0; 2.1; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-2386
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-2386
cvs.lysator.liu.se
http://cvs.lysator.liu.se/viewcvs/viewcvs.cgi/sercd/sercd.c?root=sercd
Vendor Advisory
http://secunia.com/advisories/12351
securitytracker.com
http://securitytracker.com/id?1011038
Patch
http://www.osvdb.org/8375
www.osvdb.org
http://www.osvdb.org/9104
www.securityfocus.com
http://www.securityfocus.com/bid/11002
More from Sredird
–
CVE-2004-2387
Buffer overflow in the HandleCPCCommand function of sercd before 2.3.1 and sredird 2.2.1 and earlier allows remote attackers to execute arbitrary code