CVE-2006-4127

{"id": "CVE-2006-4127", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": true, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2006-08-14T23:04:00.000", "references": [{"url": "http://secunia.com/advisories/21384", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/1377", "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1016641", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.dc.ds.pg.gda.pl/", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.dc.ds.pg.gda.pl/?page=doc&doc=changelog", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/442440/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/19371", "tags": ["Exploit", "Patch"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/3181", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28280", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Multiple format string vulnerabilities in DConnect Daemon 0.7.0 and earlier allow remote administrators to execute arbitrary code via format string specifiers that are not properly handled when calling the (1) privmsg() or (2) pubmsg functions from (a) cmd.user.c, (b) penalties.c, or (c) cmd.dc.c."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de cadena de formato en DConnect Daemon 0.7.0 y anteriores permiten a administradore remotos ejecutar c\u00f3digo de su elecci\u00f3n mediante especificadores de cadena de formato que no son manejados adecuadamente al llamar a las funciones (1) privmsg() o (2) pubmsg desde (a) cmd.user.c, (b) penalties.c, o (c) cmd.dc.c."}], "lastModified": "2018-10-17T21:33:32.050", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dconnect:dconnect_daemon:0.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C29EACF1-C006-4819-8E24-FDC6CC1BA321"}, {"criteria": "cpe:2.3:a:dconnect:dconnect_daemon:0.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A6E6F96-90F3-47CA-B6F6-B88A96A7709A"}, {"criteria": "cpe:2.3:a:dconnect:dconnect_daemon:0.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B64776EF-2736-4542-B64C-BDD413E1F91B"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org", "evaluatorSolution": "Successful exploitation of this vulnerability requires superior user or administrator privileges.\r\nThis vulnerability is addressed in the following product release:\r\nDConnect, DConnect Daemon, 0.7.1"}