HylaFAX Format String Vulnerabilities (faxrm, faxalter)
6 Oct. 2001
Summary
HylaFAX client-server protocol server contains a security vulnerability that allows local attackers to exploit a format string attack in the program, causing it to execute arbitrary code.
Credit:
The information has been provided by Christer Oberg.
Example:
The faxrm and faxalter utilities contain format string vulnerabilities that can be caused by issuing the following commands:
$ faxrm -h %x 1
$ faxalter -h %x -D 1
Since both faxrm and faxalter are installed with set user id (setuid) 'uucp' privileges on some operating systems (in particular, on FreeBSD as part of the ports collection), elevated privileges can be gained.
