Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » [CSSA-2002-036.0] Linux: remote buffer overflow in webalizer reverse lookup code

[CSSA-2002-036.0] Linux: remote buffer overflow in webalizer reverse lookup code

by Nikola Strahija on October 23rd, 2002 The webalizer program will perform reverse DNS lookups. Using a buffer overflow in this reverse lookup code, an attacker with a rogue DNS server can gain root access to the machine running webalizer.


2. Vulnerable Supported Versions

System Package
----------------------------------------------------------------------

OpenLinux 3.1.1 Server prior to webalizer-2.01_09-2.i386.rpm

OpenLinux 3.1 Server prior to webalizer-2.01_09-2.i386.rpm


3. Solution

The proper solution is to install the latest packages. Many
customers find it easier to use the Caldera System Updater, called
cupdate (or kcupdate under the KDE environment), to update these
packages rather than downloading and installing them by hand.


4. OpenLinux 3.1.1 Server

4.1 Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-036.0/RPMS

4.2 Packages

db8c5037801e807a6138f2fd5e3cf284 webalizer-2.01_09-2.i386.rpm

4.3 Installation

rpm -Fvh webalizer-2.01_09-2.i386.rpm

4.4 Source Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-036.0/SRPMS

4.5 Source Packages

03e6b22634832fd3cd1752318f1d83d4 webalizer-2.01_09-2.src.rpm


5. OpenLinux 3.1 Server

5.1 Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-036.0/RPMS

5.2 Packages

258245a154ba0b220b56cde31b2e3c7d webalizer-2.01_09-2.i386.rpm

5.3 Installation

rpm -Fvh webalizer-2.01_09-2.i386.rpm

5.4 Source Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-036.0/SRPMS

5.5 Source Packages

fef58e3e929062180bf1bc6ad885925e webalizer-2.01_09-2.src.rpm


6. References

Specific references for this advisory:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0180

SCO security resources:
http://www.sco.com/support/security/index.html

This security fix closes SCO incidents sr863733, fz520840,
erg712035.


7. Disclaimer

SCO is not responsible for the misuse of any of the information
we provide on this website and/or through our security
advisories. Our advisories are a service to our customers intended
to promote secure installation and use of SCO products.


8. Acknowledgements

Spybreak ([email protected]) discovered and researched this
vulnerability.


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »