• info
• discussion
• exploit
• solution
• references

APC apcupsd Client Syslog Format String Vulnerability

A vulnerability has been reported for the apcupsd client that may result in an attacker obtaining elevated privileges on the vulnerable system.

Due to a programming error in the 'log_event' function it may be possible to exploit a format string vulnerability. If successfully exploited this could result in the execution of attacker-supplied code.

Any code executed would be in the security context of the apcupsd process.