Hi Henne, 
the Debian folks posted this to vendor-sec (private). 
 
Date: Tue, 2 Nov 2004 09:06:07 +0100 
From: Thomas Biege <thomas@suse.de> 
To: Thomas Biege <thomas@suse.de> 
Subject: [joey@infodrom.org: [vendor-sec] CAN-2004-0980: Format string 
security vulnerability in ez-ipupdate] 
User-Agent: Mutt/1.5.6i 
 
----- Forwarded message from Martin Schulze <joey@infodrom.org> ----- 
 
From: Martin Schulze <joey@infodrom.org> 
To: vendor-sec@lst.de 
Cc: Ulf HÀrnhammar <Ulf.Harnhammar.9485@student.uu.se> 
User-Agent: Mutt/1.5.6+20040907i 
Subject: [vendor-sec] CAN-2004-0980: Format string security vulnerability in 
ez-ipupdate 
Errors-To: vendor-sec-admin@lst.de 
Date: Sun, 31 Oct 2004 10:34:12 +0100 
 
Hi, 
 
not sure if one of you is shipping ez-ipupdate but if you do, here's a 
heads up. 
 
Ulf HÀrnhammar discovered a format string vulnerability in 
ez-ipupdate, a client for many dynamic DNS services.  This problem can 
only be exploited if ez-ipupdate is running in daemon mode (most 
likely) but not in quiet mode (unlikely). 
 
I'm attaching the patch from Ulf. 
 
He will probably disclose this problem on Nov 3rd. 
 
-- 
This is GNU/Linux Country.  On a quiet night, you can hear Windows reboot. 
 
--- ez-ipupdate.c.old   2004-10-21 23:44:57.000000000 +0200 
+++ ez-ipupdate.c       2004-10-22 23:56:05.000000000 +0200 
@@ -805,7 +805,7 @@ 
     sprintf(buf, "message incomplete because your OS sucks: %s\n", fmt); 
 #endif 
 
-    syslog(LOG_NOTICE, buf); 
+    syslog(LOG_NOTICE, "%s", buf); 
   } 
   else 
   { 
 
 
----- End forwarded message -----