Detections
Analytics
Debian DSA-148-1 : hylafax - buffer overflows and format string vulnerabilities
high Nessus Plugin ID 14985
Synopsis
The remote Debian host is missing a security-related update.Description
A set of problems have been discovered in Hylafax, a flexible client/server fax software distributed with many GNU/Linux distributions. Quoting SecurityFocus the problems are in detail :- A format string vulnerability makes it possible for users to potentially execute arbitrary code on some implementations. Due to insufficient checking of input, it's possible to execute a format string attack. Since this only affects systems with the faxrm and faxalter programs installed setuid, Debian is not vulnerable.
- A buffer overflow has been reported in Hylafax. A malicious fax transmission may include a long scan line that will overflow a memory buffer, corrupting adjacent memory. An exploit may result in a denial of service condition, or possibly the execution of arbitrary code with root privileges.
- A format string vulnerability has been discovered in faxgetty. Incoming fax messages include a Transmitting Subscriber Identification (TSI) string, used to identify the sending fax machine. Hylafax uses this data as part of a format string without properly sanitizing the input. Malicious fax data may cause the server to crash, resulting in a denial of service condition.
- Marcin Dawcewicz discovered a format string vulnerability in hfaxd, which will crash hfaxd under certain circumstances. Since Debian doesn't have hfaxd installed setuid root, this problem cannot directly lead into a vulnerability. This has been fixed by Darren Nickerson, which was already present in newer versions, but not in the potato version.
These problems have been fixed in version 4.0.2-14.3 for the old stable distribution (potato), in version 4.1.1-1.1 for the current stable distribution (woody) and in version 4.1.2-2.1 for the unstable distribution (sid).
Solution
Upgrade the hylafax packages.See Also
Plugin Details
Severity: High
ID: 14985
File Name: debian_DSA-148.nasl
Version: 1.21
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 9/29/2004
Updated: 1/4/2021
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/o:debian:debian_linux:2.2, p-cpe:/a:debian:debian_linux:hylafax, cpe:/o:debian:debian_linux:3.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 8/12/2002
Vulnerability Publication Date: 4/12/2001
Reference Information
CVE: CVE-2001-0387, CVE-2001-1034, CVE-2002-1049, CVE-2002-1050
DSA: 148