CVE-2004-0353

Vulnerability

Multiple buffer overflows exist in the auth_ident() function in auth.c of GNU Anubis versions 3.6.0 through 3.6.2, 3.9.92, and 3.9.93. The overflows are caused by the use of sscanf() with "%s" format strings instead of bounded specifiers, allowing an attacker to overflow stack buffers with a long string [2].

Exploitation

An attacker can exploit this vulnerability by connecting to the Anubis server (typically on port 24) and sending a long string as part of the ident protocol response. No authentication is required. The auth_ident() function processes this input, triggering the buffer overflow. Public exploit code exists for version 3.6.2, demonstrating remote code execution [1].

Impact

Successful exploitation allows a remote attacker to execute arbitrary code with root privileges, as GNU Anubis typically runs as root before dropping privileges [2]. This results in full system compromise.

Mitigation

Patches were released by the vendor for versions 3.6.2 and 3.9.93 [3]. Users should upgrade to the patched versions or apply the available patches. Later versions of GNU Anubis are not affected. No workaround is available if patching is not possible.