CVE-2004-0992

Vulnerability

A format string vulnerability exists in Proxytunnel versions before 1.2.3 when running in daemon mode (using the -a option). The program improperly logs invalid proxy answers to syslog, allowing format string specifiers to be interpreted. Affected versions: all versions prior to 1.2.3 [1].

Exploitation

An attacker must operate a malicious proxy server that sends crafted invalid proxy answers to the Proxytunnel daemon. No authentication is required. The attacker sends format string specifiers in the proxy answer, which are then processed by the syslog function, leading to arbitrary code execution [1].

Impact

Successful exploitation allows arbitrary code execution with the privileges of the Proxytunnel process, leading to full compromise of the tunnelling host [1].

Mitigation

Upgrade to Proxytunnel 1.2.3 or later [1]. As a workaround, restrict connections to trusted remote servers only [1].