← Vulnerability feed

Vulnerability record · CVE-2004-1702 · published 9 August 2004

CVE-2004-1702: Gnu cfengine vulnerability

Gnu · Cfengine

The AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 does not properly check the return value of the ReceiveTransaction function, which leads to a failed malloc call and triggers to a null dereference, which allows remote attackers to cause a denial of service (crash).

5.0 CVSS 2.0 Medium EPSS 2.4% · top 16.6%
5.0CVSS 2.0 base score
2.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References, 4 tagged exploit
16 Jun 2026Last modified by NVD

Description

The AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 does not properly check the return value of the ReceiveTransaction function, which leads to a failed malloc call and triggers to a null dereference, which allows remote attackers to cause a denial of service (crash).

AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://marc.info/?l=bugtraq&m=109208394910086&w=2
http://secunia.com/advisories/12251 PatchVendor Advisory
http://security.gentoo.org/glsa/glsa-200408-08.xml ExploitPatchVendor Advisory
http://www.coresecurity.com/common/showdoc.php?idx=387&idxseccion=10 ExploitPatchVendor Advisory
http://www.securityfocus.com/bid/10900 PatchVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/16937
http://marc.info/?l=bugtraq&m=109208394910086&w=2
http://secunia.com/advisories/12251 PatchVendor Advisory
http://security.gentoo.org/glsa/glsa-200408-08.xml ExploitPatchVendor Advisory
http://www.coresecurity.com/common/showdoc.php?idx=387&idxseccion=10 ExploitPatchVendor Advisory
http://www.securityfocus.com/bid/10900 PatchVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/16937

Track CVE-2004-1702 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2004-1701Gnu cfengine vulnerabilityHeap-based buffer overflow in the AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 allows remote attackers to execute arbitra…EPSS 20%10.0CVE-2000-0947Gnu cfengine vulnerabilityFormat string vulnerability in cfd daemon in GNU CFEngine before 1.6.0a11 allows attackers to execute arbitrary commands via format characters in the…EPSS 2.5%7.5CVE-2003-0849Gnu cfengine vulnerabilityBuffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length val…EPSS 11%2.1CVE-2005-2960Gnu cfengine vulnerabilitycfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in, a different vulner…EPSS 0.43%2.1CVE-2005-3137Gnu cfengine vulnerabilityThe (1) cfmailfilter and (2) cfcron.in files for cfengine 1.6.5 allow local users to overwrite arbitrary files via a symlink attack on temporary file…EPSS 0.43%

Source: NIST National Vulnerability Database (record CVE-2004-1702), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.