webalizer: reverse DNS buffer overflow vulnerability [LWN.net]

Package(s):

webalizer

CVE #(s):

Created:

May 21, 2002

Updated:

January 27, 2003

Description:

The cause is a buffer overflow bug. This one sounds nasty. If reverse DNS lookups are enabled in webalizer, "an attacker with control over the victims DNS may spoof responses thus triggering a buffer overflow, potentially leading to a root compromise." Webalizer 2.01-10 "fixes this and a few other buglets that have been discovered in the last month or so". (First LWN report: April 18th, 2002).

Alerts:

Yellow Dog	YDU-20030127-4	2003-01-27
Red Hat	RHSA-2002:254-05	2002-12-04
SCO Group	CSSA-2002-036.0	2002-10-22
EnGarde	ESA-20020423-009	2002-04-23
Conectiva	CLA-2002:476	2002-04-26

(Log in to post comments)