full-disclosure - formatfun

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20060327132147.GA9761@suse.de>
Date: Mon Mar 27 14:21:55 2006
From: meissner at suse.de (Marcus Meissner)
Subject: formatfun

On Fri, Mar 24, 2006 at 05:51:04PM +0100, kcope wrote:
> Hello,
> 
> mod_ssl:
> /httpd-2.0.48/modules/ssl/ssl_engine_kernel.c (also in 2.0.55)
> proto:        
> ap_log_error(constchar*file,intline,intlevel,apr_status_tstatus,constserver_rec*s,constchar*fmt,...) 
> 
> code:         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, buff);
> is this exploitable?

Not considered exploitable by the Apache team.
http://issues.apache.org/bugzilla/show_bug.cgi?id=30585                                  

Ciao, Marcus