bugtraq - IMENDIO PLANNER REMOTE FILENAME FORMAT STRING VULNERABILITY

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: 7 Aug 2006 08:59:05 -0000
From: king_purba@...oo.co.uk
To: bugtraq@...urityfocus.com
Subject: IMENDIO PLANNER REMOTE FILENAME FORMAT STRING VULNERABILITY

By : LoneEagle 
E-mail : king_purba@...oo.co.uk
http://kandangjamur.net
Affected :
IMENDIO PLANNER 0.13
PROJECT MANAGEMENT FEDORA 4.
Impact : System Acces
>From : Remote
Severity : Moderately Critical

Description:
------------
Imendio planner was failed when opening file name format string.
Remote attacker can exploit this vulnerabilty by creating a malicious 
filename that contain format string specifier. Successfull attacking can be used 
for executing arbitrary code.

Solution :
----------
Don't open file from untursted source.