CVE-2002-0913

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Format string vulnerability in log_doit function of Slurp NNTP client 1.1.0 allows a malicious news server to execute arbitrary code on the client via format strings in a server response.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2002-06/0014.html
http://marc.info/?l=vuln-dev&m=102323341407280&w=2
http://www.iss.net/security_center/static/9270.phpVendor Advisory
http://www.securityfocus.com/bid/4935Exploit, Patch, Vendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2002-06/0014.html
http://marc.info/?l=vuln-dev&m=102323341407280&w=2
http://www.iss.net/security_center/static/9270.phpVendor Advisory
http://www.securityfocus.com/bid/4935Exploit, Patch, Vendor Advisory

Timeline

Published: Oct 4, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-09145.0Double Precision Courier e-mail MTA allows remote attackers to cause a denial of service (CPU consumption) via a message with an extremely l CVE-2002-09152.1autorun in Xandros based Linux distributions allows local users to read the first line of arbitrary files via the -c parameter, which causes CVE-2002-09167.5Format string vulnerability in the allowuser code for the Stellar-X msntauth authentication module, as distributed in Squid 2.4.STABLE6 and CVE-2002-09177.5CGIScript.net csPassword.cgi stores .htpasswd files under the web document root, which could allow remote authenticated users to download th CVE-2002-09185.0CGIScript.net csPassword.cgi leaks sensitive information such as the pathname of the server in debug messages that are presented when the sc CVE-2002-09197.5CGIScript.net csPassword.cgi allows remote authenticated users to modify the .htaccess file and gain privileges via newlines in the title fi CVE-2002-09205.1CGIScript.net csPassword.cgi stores usernames and unencrypted passwords in the password.cgi.tmp temporary file while modifying data, which c CVE-2002-09215.0CGIScript.net csNews.cgi allows remote attackers to obtain potentially sensitive information, such as the full server pathname and other con CVE-2002-09225.0CGIScript.net csNews.cgi allows remote attackers to obtain database files via a direct URL-encoded request to (1) default%2edb or (2) defaul CVE-2002-09237.5CGIScript.net csNews.cgi allows remote authenticated users to read arbitrary files, and possibly gain privileges, via the (1) pheader or (2)CVE-2002-09247.5CGIScript.net csNews.cgi allows remote authenticated users to execute arbitrary Perl code via terminating quotes and metacharacters in text CVE-2002-09257.5Format string vulnerability in mmsyslog function allows remote attackers to execute arbitrary code via (1) the USER command to mmpop3d for m