CVE-2005-3539

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 13%

from disclosure to weapon0 days

Published on NVDJan 6

1st PoCJan 5

exploitation probability

13%top 4% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

Multiple eval injection vulnerabilities in HylaFAX 4.2.3 and earlier allow remote attackers to execute arbitrary commands via (1) the notify script in HylaFAX 4.2.0 to 4.2.3 and (2) crafted CallID parameters to the faxrcvd script in HylaFAX 4.2.2 and 4.2.3.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/27032

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://bugs.hylafax.org/bugzilla/show_bug.cgi?id=719 http://secunia.com/advisories/18314 http://secunia.com/advisories/18337 http://secunia.com/advisories/18366 http://secunia.com/advisories/18489 http://www.debian.org/security/2005/dsa-933 http://www.gentoo.org/security/en/glsa/glsa-200601-03.xml http://www.hylafax.org/content/HylaFAX_4.2.4_release http://www.mandriva.com/security/advisories?name=MDKSA-2006:015 http://www.securityfocus.com/archive/1/420974/100/0/threaded http://www.securityfocus.com/bid/16151 http://www.vupen.com/english/advisories/2006/0072