Multiple buffer overflows in apcupsd before 3.8.6, and 3.10.x before 3.10.5, may allow attackers to cause a denial of service or execute arbitrary code, related to usage of the vsprintf function.

The controlling and management daemon apcupsd for APC's Unbreakable Power Supplies is vulnerable to several buffer overflows and format string attacks. These bugs can be exploited remotely by an attacker to gain root access to the machine apcupsd is running on.

The remote host is running a version of apcupsd which is vulnerable to a buffer overflow. An attacker could exploit this flaw to gain a root shell on this host.

A remote root vulnerability in slave setups and some buffer overflows in the network information server code were discovered by the apcupsd developers. They have been fixed in the latest unstable version, 3.10.5 which contains additional enhancements like USB support, and the latest stable version, 3.8.6.

There are a few changes that need to be noted, such as the port has changed from port 7000 to post 3551 for NIS, and the new config only allows access from the localhost. Users may need to modify their configuration files appropriately, depending upon their configuration.

The remote host is missing the patch for the advisory SUSE-SA:2003:022 (apcupsd).


The controlling and management daemon apcupsd for APC's Unbreakable Power Supplies is vulnerable to several buffer overflows and format bugs. These bugs can be exploited remotely by an attacker to gain root access to the machine apcupsd is running on.

There is no temporary fix known.

Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply the update.

The remote host is running the apcupsd client which, according to its version number, is affected by multiple vulnerabilities :

  - The configuration file '/var/run/apcupsd.pid' is by     default world-writable. A local attacker could re-write     this file with other process IDs in order to crash the     affected system.

  - An issue exists in the 'log_event' function which a     local attacker could exploit in order to execute     arbitrary code.

  - Several buffer overflow vulnerabilities have been     reported which a remote attacker could exploit in order     to execute arbitrary code on the remote host.

*** Nessus solely relied on the version number of the 
*** remote server, so this might be a false positive

ID	Name	Product	Family	Severity
15114	Debian DSA-277-1 : apcupsd - buffer overflows, format string	Nessus	Debian Local Security Checks	critical
1891	apcupsd Overflow	Nessus Network Monitor	Generic	critical
14003	Mandrake Linux Security Advisory : apcupsd (MDKSA-2003:018)	Nessus	Mandriva Local Security Checks	critical
13792	SUSE-SA:2003:022: apcupsd	Nessus	SuSE Local Security Checks	critical
11484	APC < 3.8.0 apcupsd Multiple Vulnerabilities	Nessus	Gain a shell remotely	critical

Detections

Analytics

CVE-2003-0099

critical

Tenable Plugins

critical

critical

critical

critical

critical