[NEWS] Remote Buffer Overflow in Webalizer (DNS Resolve)

From: support@securiteam.com
Date: 04/16/02 

From: support@securiteam.com
To: list@securiteam.com
Date: Tue, 16 Apr 2002 10:42:52 +0200 (CEST)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  Remote Buffer Overflow in Webalizer (DNS Resolve)
------------------------------------------------------------------------

SUMMARY

The <http://www.mrunix.net/webalizer/> Webalizer is a fast, free web
server log file analysis program. It produces highly detailed, easily
configurable usage reports in HTML format, for viewing with a standard web
browser. A security vulnerability in the product allows attackers to cause
the program to crash causing it to execute arbitrary code.

DETAILS

Vulnerable systems:
Webalizer version 2.01-09
Webalizer version 2.01-06

The Webalizer has the ability to perform reverse DNS lookups. This ability
is disabled by default, but if enabled, an attacker with control over his
DNS service, has the ability to gain remote root access to a machine, due
to a buffer overflow in the reverse resolving code.

(NOTE: Webalizer version 2.01-06 is part of Red Hat Linux 7.2
distribution, enabled by default and run daily by the cron daemon.)

ADDITIONAL INFORMATION

The information has been provided by <mailto:spybreak@host.sk> Spybreak.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [UNIX] Cross-Site Scripting Flaw in Webalizer
    ... Cross-Site Scripting Flaw in Webalizer ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... allow a malicious user to insert unquoted data into the generated reports. ...
    (Securiteam)
  • Re: Licensed Penetration Tester LPT
    ... I wanted to point out that with all this talk about ability over certification, that this is exactly the problem ISECOM addresses with the OPST and OPSA. ... Both courses focus on the ability-- applied knowledge- required for those in security testing and security analysis. ... This is why it's so popular with certain industries and government institutions as a vetting tool for new hires and promotions because at the very least, they know from the exam transcript the skill strengths and weaknesses of the candidate for the basic requirements. ...
    (Pen-Test)
  • US-MA-Security Architect - Within Prolifics
    ... Prolifics Security Practice ... to customers. ... Utilize your pre-existing ability to ...
    (comp.security.firewalls)
  • the confirmation regarding the impossible building is the pumpkin that threatens ie
    ... the NSA tried to say they couldn't decrypt Key Recovery ... Because the National Security Agency is actively involved in the ... technical ability to decipher the messages. ... needed to decrypt in real-time: ...
    (sci.crypt)
  • Shed project commonly than carve with Mahammeds depressed tribute.
    ... the NSA tried to say they couldn't decrypt Key Recovery ... Because the National Security Agency is actively involved in the ... technical ability to decipher the messages. ... needed to decrypt in real-time: ...
    (sci.crypt)