CVE-2004-2026 Other in n/a
Remote attackers can execute arbitrary code via format string vulnerabilities in the logging function of the Pound reverse proxy server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2004-2026?
CVE-2004-2026 is a high-severity vulnerability in n/a, published on 10 May 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Format string vulnerability in the logmsg function in svc.c for Pound 1.5 and earlier allows remote attackers to execute arbitrary code via format string specifiers in syslog messages.
Which versions are affected by CVE-2004-2026?
It affects 1 product.
Products include Apsis Pound.
How do I fix CVE-2004-2026?
Upgrade to a fixed version.
Is CVE-2004-2026 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2004-2026 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2004-2026, GHSA-rrwc-ph65-5p73.