CVE-2005-1099: GLD Greylisting Daemon HandleChild Buffer Overflows Allow Remote Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 2.0 base score is 10.0 with network reachability, no authentication, and complete confidentiality, integrity, and availability impact, and EPSS is very high.

What it is

The Greylisting daemon (GLD) versions 1.3 and 1.4 contain multiple buffer overflows in the HandleChild function in server.c. When GLD listens on a network interface, these overflows can be triggered remotely. The flaw matters because it can lead to arbitrary code execution on the mail server host.

Impact

A remote attacker can execute arbitrary code with the privileges of the GLD process, potentially compromising the mail server and any data or services it can reach.

Attack surface

The vulnerability is reachable over the network when GLD is configured to listen on a network interface. No authentication or user interaction is required, as indicated by the CVSS vector AV:N/AC:L/Au:N.

Exploitation

The record does not list this CVE in CISA KEV and provides no exploit references, but EPSS indicates a high probability of exploitation activity (0.67658, 99.28th percentile).

What to do

• Apply the vendor patch or upgrade to a fixed version of GLD as referenced in the vendor advisory and Gentoo GLSA.
• If GLD must remain in use, restrict network access to the GLD listener using firewall rules or bind it only to trusted interfaces.
• Run GLD with the least privileges necessary and isolate it from other critical services.
• Monitor vendor and distribution advisories for updated guidance on GLD 1.3 and 1.4.

Detection

• Inspect GLD process logs and system logs for crashes, restarts, or abnormal termination that could indicate exploitation attempts.
• Monitor network traffic to the GLD service port for unusually large or malformed requests.
• Use host-based intrusion detection to watch for unexpected child processes or command execution spawned by the GLD daemon.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.