CVE-2004-2417: Format string vulnerability in smtp.c for smtp.proxy 1.1.3 and earlier allows remote attackers to execute a...

Security readout for executives and security teams

CVE-2004-2417 affects smtp.proxy 1.1.3 and earlier. A remote attacker could cause attacker-controlled text in a client hostname or message-id to be written unsafely to syslog, potentially allowing arbitrary code execution. The sources do not provide CVSS, patch details, or active exploitation evidence. Exposure is most likely in legacy environments still running smtp.proxy 1.1.3 or earlier, especially where the proxy processes SMTP traffic from untrusted networks. Modern exposure is probably limited, but asset discovery is necessary because the affected product is old. Prioritize confirmation over broad emergency response. If smtp.proxy 1.1.3 or earlier is internet-facing, treat remediation as urgent because the reported impact is remote arbitrary code execution. If absent, record the exception and move on. Mitigation focus: Inventory systems for smtp.proxy 1.1.3 or earlier.; Check vendor or archive guidance for fixed versions or retirement advice.; Replace or remove unsupported smtp.proxy deployments where feasible..

Prepared

Jun 29, 2026, 18:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.