SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Webalizer Vendors:   Barrett, Bradford L.
(Caldera Issues Fix) Webalizer Buffer Overflow Allows Remote Users to Execute Arbitrary Code on the Server via Reverse DNS Lookups
SecurityTracker Alert ID:  1005475
SecurityTracker URL:  http://securitytracker.com/id/1005475
CVE Reference:   CVE-2002-0180   (Links to External Site)
Date:  Oct 24 2002
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2.01-09, 2.01-06
Description:   A buffer overflow vulnerability was reported in Webalizer, a log file analysis tool. A remote user can cause arbitrary code to be executed on the server.

If Webalizer is configured to perform reverse DNS lookups (which is apparently not the default configuration), a remote user with control over a DNS service can cause arbitrary code to be executed by Webalizer. No further details were provided.

The vendor has reportedly been notified.

Impact:   A remote user with control over a DNS server can cause Webalizer to execute arbitrary code on the Webalizer host when performing a reverse DNS lookup.
Solution:   Caldera has released a fix.

For OpenLinux 3.1.1 Server:

Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-036.0/RPMS

Packages

db8c5037801e807a6138f2fd5e3cf284 webalizer-2.01_09-2.i386.rpm

Installation

rpm -Fvh webalizer-2.01_09-2.i386.rpm

Source Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-036.0/SRPMS

Source Packages

03e6b22634832fd3cd1752318f1d83d4 webalizer-2.01_09-2.src.rpm


For OpenLinux 3.1 Server:

Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-036.0/RPMS

Packages

258245a154ba0b220b56cde31b2e3c7d webalizer-2.01_09-2.i386.rpm

Installation

rpm -Fvh webalizer-2.01_09-2.i386.rpm

Source Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-036.0/SRPMS

Source Packages

fef58e3e929062180bf1bc6ad885925e webalizer-2.01_09-2.src.rpm

Vendor URL:  www.mrunix.net/webalizer/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Caldera/SCO)
Underlying OS Comments:  3.1, 3.1.1

Message History:   This archive entry is a follow-up to the message listed below.
Apr 15 2002 Webalizer Buffer Overflow Allows Remote Users to Execute Arbitrary Code on the Server via Reverse DNS Lookups



 Source Message Contents

Subject:  Security Update: [CSSA-2002-036.0] Linux: remote buffer overflow in webalizer reverse lookup code


--i9LlY+UWpKt15+FH
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

To: bugtraq@securityfocus.com announce@lists.caldera.com security-alerts@linuxsecurity.com full-disclosure@lists.netsys.com


______________________________________________________________________________

			SCO Security Advisory

Subject:		Linux: remote buffer overflow in webalizer reverse lookup code
Advisory number: 	CSSA-2002-036.0
Issue date: 		2002 October 22
Cross reference:
______________________________________________________________________________


1. Problem Description

	The webalizer program will perform reverse DNS lookups. Using
	a buffer overflow in this reverse lookup code, an attacker with
	a rogue DNS server can gain root access to the machine running
	webalizer.


2. Vulnerable Supported Versions

	System				Package
	----------------------------------------------------------------------

	OpenLinux 3.1.1 Server		prior to webalizer-2.01_09-2.i386.rpm

	OpenLinux 3.1 Server		prior to webalizer-2.01_09-2.i386.rpm


3. Solution

	The proper solution is to install the latest packages. Many
	customers find it easier to use the Caldera System Updater, called
	cupdate (or kcupdate under the KDE environment), to update these
	packages rather than downloading and installing them by hand.


4. OpenLinux 3.1.1 Server

	4.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-036.0/RPMS

	4.2 Packages

	db8c5037801e807a6138f2fd5e3cf284	webalizer-2.01_09-2.i386.rpm

	4.3 Installation

	rpm -Fvh webalizer-2.01_09-2.i386.rpm

	4.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-036.0/SRPMS

	4.5 Source Packages

	03e6b22634832fd3cd1752318f1d83d4	webalizer-2.01_09-2.src.rpm


5. OpenLinux 3.1 Server

	5.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-036.0/RPMS

	5.2 Packages

	258245a154ba0b220b56cde31b2e3c7d	webalizer-2.01_09-2.i386.rpm

	5.3 Installation

	rpm -Fvh webalizer-2.01_09-2.i386.rpm

	5.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-036.0/SRPMS

	5.5 Source Packages

	fef58e3e929062180bf1bc6ad885925e	webalizer-2.01_09-2.src.rpm


6. References

	Specific references for this advisory:
		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0180

	SCO security resources:
		http://www.sco.com/support/security/index.html

	This security fix closes SCO incidents sr863733, fz520840,
	erg712035.


7. Disclaimer

	SCO is not responsible for the misuse of any of the information
	we provide on this website and/or through our security
	advisories. Our advisories are a service to our customers intended
	to promote secure installation and use of SCO products.


8. Acknowledgements

	Spybreak (spybreak@host.sk) discovered and researched this
	vulnerability.

______________________________________________________________________________

--i9LlY+UWpKt15+FH
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAj2235EACgkQbluZssSXDTEdNQCeKjUtNy2cNBM3ApSprTaVHQeA
EV4AoNO1lSQ6EXhJ3AS5knIaMiTvoqbQ
=QpfT
-----END PGP SIGNATURE-----

--i9LlY+UWpKt15+FH--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC