Detections
Analytics

Network Solutions Rwhoisd Syslog Remote Format String

high Nessus Plugin ID 10804

Synopsis

Arbitrary code may be run on the remote server.

Description

The remote rwhois daemon is vulnerable to a format string attack when supplied malformed arguments to a malformed request (such as %p%p%p).

An attacker may use this flaw to gain a shell on this host.

*** Note that Nessus solely relied on the banner version to
*** issue this warning. If you manually patched rwhoisd, you
*** may not be vulnerable to this flaw

Solution

Disable this service or upgrade to version 1.5.7.3 or newer

Plugin Details

Severity: High

ID: 10804

File Name: rwhois_format_string2.nasl

Version: 1.14

Type: remote

Published: 11/25/2001

Updated: 8/13/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

Vulnerability Publication Date: 11/22/2001

Reference Information

CVE: CVE-2001-0913