CVE-2002-0925

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2002-10-04 · updated 2026-06-16

Description

Format string vulnerability in mmsyslog function allows remote attackers to execute arbitrary code via (1) the USER command to mmpop3d for mmmail 0.0.13 and earlier, (2) the HELO command to mmsmtpd for mmmail 0.0.13 and earlier, or (3) the USER command to mmftpd 0.0.7 and earlier.

Affected products

Matthew Mondor Mmftpd: through 0.0.7
Matthew Mondor Mmmail: through 0.0.13

References

http://archives.neohapsis.com/archives/bugtraq/2002-06/0095.html
http://mmondor.gobot.ca/software/linux/mmftpd-changelog.txt
http://mmondor.gobot.ca/software/linux/mmmail-changelog.txt
http://online.securityfocus.com/archive/1/276523
http://www.iss.net/security_center/static/9336.php
http://www.iss.net/security_center/static/9337.php
http://www.securityfocus.com/bid/4990
http://www.securityfocus.com/bid/4999
http://archives.neohapsis.com/archives/bugtraq/2002-06/0095.html
http://mmondor.gobot.ca/software/linux/mmftpd-changelog.txt
http://mmondor.gobot.ca/software/linux/mmmail-changelog.txt
http://online.securityfocus.com/archive/1/276523

Get alerted when CVE-2002-0925 or the next vulnerability affects your stack