VulnerabilityModified

CVE-2002-0925

Format string vulnerability in mmsyslog function allows remote attackers to execute arbitrary code via (1) the USER command to mmpop3d for mmmail 0.0.13 and earlier, (2) the HELO command to mmsmtpd for mmmail 0.0.13 and earlier, or (3) the USER command…

HIGH 7.5EPSS 3.39%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (3.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 3.39% probability · 88th percentile
CISA KEV: Not listed
Affected: matthew mondor/mmftpd · matthew mondor/mmmail
Source: cve@mitre.org

References

http://archives.neohapsis.com/archives/bugtraq/2002-06/0095.html
http://mmondor.gobot.ca/software/linux/mmftpd-changelog.txt
http://mmondor.gobot.ca/software/linux/mmmail-changelog.txt
http://online.securityfocus.com/archive/1/276523
http://www.iss.net/security_center/static/9336.phpPatch, Vendor Advisory
http://www.iss.net/security_center/static/9337.phpPatch, Vendor Advisory
http://www.securityfocus.com/bid/4990Patch, Vendor Advisory
http://www.securityfocus.com/bid/4999Patch, Vendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2002-06/0095.html
http://mmondor.gobot.ca/software/linux/mmftpd-changelog.txt
http://mmondor.gobot.ca/software/linux/mmmail-changelog.txt
http://online.securityfocus.com/archive/1/276523
http://www.iss.net/security_center/static/9336.phpPatch, Vendor Advisory
http://www.iss.net/security_center/static/9337.phpPatch, Vendor Advisory
http://www.securityfocus.com/bid/4990Patch, Vendor Advisory
http://www.securityfocus.com/bid/4999Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.