| ID |
CVE-2006-4127
|
| Summary |
Multiple format string vulnerabilities in DConnect Daemon 0.7.0 and earlier allow remote administrators to execute arbitrary code via format string specifiers that are not properly handled when calling the (1) privmsg() or (2) pubmsg functions from (a) cmd.user.c, (b) penalties.c, or (c) cmd.dc.c. Successful exploitation of this vulnerability requires superior user or administrator privileges.
This vulnerability is addressed in the following product release:
DConnect, DConnect Daemon, 0.7.1 |
| References |
|
| Vulnerable Configurations |
-
cpe:2.3:a:dconnect:dconnect_daemon:0.0.2:*:*:*:*:*:*:*
cpe:2.3:a:dconnect:dconnect_daemon:0.0.2:*:*:*:*:*:*:*
-
cpe:2.3:a:dconnect:dconnect_daemon:0.0.3:*:*:*:*:*:*:*
cpe:2.3:a:dconnect:dconnect_daemon:0.0.3:*:*:*:*:*:*:*
-
cpe:2.3:a:dconnect:dconnect_daemon:0.7.0:*:*:*:*:*:*:*
cpe:2.3:a:dconnect:dconnect_daemon:0.7.0:*:*:*:*:*:*:*
|
| CVSS |
| Base: | 4.6 (as of 17-10-2018 - 21:33) |
| Impact: | |
| Exploitability: | |
|
| CWE |
NVD-CWE-Other |
| CAPEC |
|
| Access |
| Vector | Complexity | Authentication |
| NETWORK |
HIGH |
SINGLE |
|
| Impact |
| Confidentiality | Integrity | Availability |
| PARTIAL |
PARTIAL |
PARTIAL |
|
| cvss-vector
via4
|
AV:N/AC:H/Au:S/C:P/I:P/A:P
|
| refmap
via4
|
| bid | 19371 | | bugtraq | 20060806 Multiple vulnerabilities in DConnect Daemon 0.7.0 (CVS 30 Jul 2006) | | confirm | | | sectrack | 1016641 | | secunia | 21384 | | sreason | 1377 | | vupen | ADV-2006-3181 | | xf | dconnect-daemon-privmsg-pubmsg-format-string(28280) |
|
| Last major update |
17-10-2018 - 21:33 |
| Published |
14-08-2006 - 23:04 |
| Last modified |
17-10-2018 - 21:33 |
