APP: LibGTop Format String Attack
This signature detects attempts to exploit a known vulnerability in libgtop. Attackers can send a malformed request that can allow them to take control of the server with libgtop process privileges.
Extended Description
The GNOME libgtop_daemon is used to monitor processes running on a remote Linux system running GNOME. Under some conditions, when a remote connection fails, user supplied input is used as a format string within a log message. A malicious user may construct a string including format modifiers, causing stack information to be written to the log file, and possibly leading to remote execution of arbitrary code. Older versions of libgtop_daemon may share this vulnerability.
Affected Products
Gnome libgtop_daemon
Short Name
APP:LIBGTOP-FMT-STR
Severity
Major
Recommended
False
Recommended Action
Drop
Category
APP
Keywords
Attack CVE-2001-0927 Format LibGTop String bid:3586
Release Date
03/30/2005
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3336
Port
TCP/42800
False Positive
Unknown
Vendors
Gnome
CVSS Score
7.5