CVE-2004-2417

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Format string vulnerability in smtp.c for smtp.proxy 1.1.3 and earlier allows remote attackers to execute arbitrary code via format string specifiers in the (1) client hostname or (2) message-id, which are injected into a syslog message.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/fulldisclosure/2004-06/0267.htmlPatch, Vendor Advisory
http://secunia.com/advisories/11823Vendor Advisory
http://www.osvdb.org/6838
http://www.securityfocus.com/bid/10509
https://exchange.xforce.ibmcloud.com/vulnerabilities/16378
http://archives.neohapsis.com/archives/fulldisclosure/2004-06/0267.htmlPatch, Vendor Advisory
http://secunia.com/advisories/11823Vendor Advisory
http://www.osvdb.org/6838
http://www.securityfocus.com/bid/10509
https://exchange.xforce.ibmcloud.com/vulnerabilities/16378

Timeline

Published: Dec 31, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-24187.2Buffer overflow in SlimFTPd 3.15 and earlier allows local users to execute arbitrary code via a long command, such as (1) CWD, (2) STOR, (3)CVE-2004-24192.1Keene Digital Media Server 1.0.2 allows local users to obtain usernames and passwords by reading the dmscore.db file on the local system.CVE-2004-24205.0Hitachi Job Management Partner (JP1) JP1/File Transmission Server/FTP 6 and 7 allows remote attackers to cause a denial of service (daemon h CVE-2004-242110.0Unknown vulnerability in Hitachi Job Management Partner (JP1) JP1/File Transmission Server/FTP 6 and 7, when running on HP-UX in trusted mod CVE-2004-24225.0Multiple features in Ipswitch IMail Server before 8.13 allow remote attackers to cause a denial of service (crash) via (1) a long sender fie CVE-2004-24235.0Unknown vulnerability in the Web calendaring component of Ipswitch IMail Server before 8.13 allows remote attackers to cause a denial of ser CVE-2004-24245.0BEA WebLogic Server and WebLogic Express 8.1 through 8.1 SP2 allow remote attackers to cause a denial of service (network port consumption) CVE-2004-24257.5Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to execute arbitrary commands via accent (`CVE-2004-24265.0Directory traversal vulnerability in Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to byp CVE-2004-242710.0Axis Network Camera 2.40 and earlier, and Video Server 3.12 and earlier, allows remote attackers to obtain sensitive information via direct CVE-2004-24285.0Abczone.it WWWguestbook 1.1 stores db/dbase.mdb under the web document root with insufficient access control, which allows remote attackers CVE-2004-24297.5Multiple stack-based and heap-based buffer overflows in EnderUNIX spamGuard before 1.7-BETA allow remote attackers to execute arbitrary code