Ecartis/Listar Buffer Overflow Vulnerability
BID:4176
Info
Ecartis/Listar Buffer Overflow Vulnerability
| Bugtraq ID: | 4176 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2002-0467 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 09 2002 12:00AM |
| Updated: | Jul 11 2009 10:56AM |
| Credit: | Credited to [email protected]. |
| Vulnerable: |
Listar Listar 0.129 a Listar Listar 0.127 a Listar Listar 0.126 a Ecartis Ecartis 1.0 .0 snapshot 20020121 |
| Not Vulnerable: |
Listar Listar 0.129 a Ecartis Ecartis 1.0 .0 snapshot 20020125 |
Discussion
Ecartis/Listar Buffer Overflow Vulnerability
Ecartis is the new name for the Listar software product. Listar is a mailing list management package for Linux, BSD, and other Unix like operating systems.
A vulnerability has been announced in some versions of Ecartis and Listar. It is possible for user supplied input to overflow a buffer. This may result in stack data being overwritten with user supplied values, including the return address of a function call. If successfully exploited, this may result in the execution of arbitrary code.
Listar normally runs as the non-privileged user 'listar'. However, exploitation of this vulnerability may result in local access for an attacker. From a local standpoint, further elevation of privileges may be easier to obtain.
Ecartis is the new name for the Listar software product. Listar is a mailing list management package for Linux, BSD, and other Unix like operating systems.
A vulnerability has been announced in some versions of Ecartis and Listar. It is possible for user supplied input to overflow a buffer. This may result in stack data being overwritten with user supplied values, including the return address of a function call. If successfully exploited, this may result in the execution of arbitrary code.
Listar normally runs as the non-privileged user 'listar'. However, exploitation of this vulnerability may result in local access for an attacker. From a local standpoint, further elevation of privileges may be easier to obtain.
Solution / Fix
Ecartis/Listar Buffer Overflow Vulnerability
Solution:
Updates are available:
Listar Listar 0.126 a
Listar Listar 0.127 a
Listar Listar 0.129 a
Ecartis Ecartis 1.0 .0 snapshot 20020121
Solution:
Updates are available:
Listar Listar 0.126 a
-
Ecartis ecartis-1.0.0-snap20020125.i386.rpm
ftp://ftp.ecartis.org/pub/ecartis/snapshots/rpm/ecartis-1.0.0-snap2002 0125.i386.rpm -
Ecartis ecartis-1.0.0-snap20020125.tar.gz
ftp://ftp.ecartis.org/pub/ecartis/snapshots/tar/ecartis-1.0.0-snap2002 0125.tar.gz
Listar Listar 0.127 a
-
Ecartis ecartis-1.0.0-snap20020125.i386.rpm
ftp://ftp.ecartis.org/pub/ecartis/snapshots/rpm/ecartis-1.0.0-snap2002 0125.i386.rpm -
Ecartis ecartis-1.0.0-snap20020125.tar.gz
ftp://ftp.ecartis.org/pub/ecartis/snapshots/tar/ecartis-1.0.0-snap2002 0125.tar.gz
Listar Listar 0.129 a
-
Debian listar-cgi_0.129a-2.potato1_alpha.deb
http://security.debian.org/dists/stable/updates/main/binary-alpha/list ar-cgi_0.129a-2.potato1_alpha.deb -
Debian listar-cgi_0.129a-2.potato1_arm.deb
http://security.debian.org/dists/stable/updates/main/binary-arm/listar -cgi_0.129a-2.potato1_arm.deb -
Debian listar-cgi_0.129a-2.potato1_i386.deb
http://security.debian.org/dists/stable/updates/main/binary-i386/lista r-cgi_0.129a-2.potato1_i386.deb -
Debian listar-cgi_0.129a-2.potato1_m68k.deb
http://security.debian.org/dists/stable/updates/main/binary-m68k/lista r-cgi_0.129a-2.potato1_m68k.deb -
Debian listar-cgi_0.129a-2.potato1_powerpc.deb
http://security.debian.org/dists/stable/updates/main/binary-powerpc/li star-cgi_0.129a-2.potato1_powerpc.deb -
Debian listar-cgi_0.129a-2.potato1_sparc.deb
http://security.debian.org/dists/stable/updates/main/binary-sparc/list ar-cgi_0.129a-2.potato1_sparc.deb -
Debian listar_0.129a-2.potato1_alpha.deb
http://security.debian.org/dists/stable/updates/main/binary-alpha/list ar_0.129a-2.potato1_alpha.deb -
Debian listar_0.129a-2.potato1_arm.deb
http://security.debian.org/dists/stable/updates/main/binary-arm/listar _0.129a-2.potato1_arm.deb -
Debian listar_0.129a-2.potato1_i386.deb
http://security.debian.org/dists/stable/updates/main/binary-i386/lista r_0.129a-2.potato1_i386.deb -
Debian listar_0.129a-2.potato1_m68k.deb
http://security.debian.org/dists/stable/updates/main/binary-m68k/lista r_0.129a-2.potato1_m68k.deb -
Debian listar_0.129a-2.potato1_powerpc.deb
http://security.debian.org/dists/stable/updates/main/binary-powerpc/li star_0.129a-2.potato1_powerpc.deb -
Debian listar_0.129a-2.potato1_sparc.deb
http://security.debian.org/dists/stable/updates/main/binary-sparc/list ar_0.129a-2.potato1_sparc.deb -
Ecartis ecartis-1.0.0-snap20020125.i386.rpm
ftp://ftp.ecartis.org/pub/ecartis/snapshots/rpm/ecartis-1.0.0-snap2002 0125.i386.rpm -
Ecartis ecartis-1.0.0-snap20020125.tar.gz
ftp://ftp.ecartis.org/pub/ecartis/snapshots/tar/ecartis-1.0.0-snap2002 0125.tar.gz
Ecartis Ecartis 1.0 .0 snapshot 20020121
-
Ecartis ecartis-1.0.0-snap20020125.i386.rpm
ftp://ftp.ecartis.org/pub/ecartis/snapshots/rpm/ecartis-1.0.0-snap2002 0125.i386.rpm -
Ecartis ecartis-1.0.0-snap20020125.tar.gz
ftp://ftp.ecartis.org/pub/ecartis/snapshots/tar/ecartis-1.0.0-snap2002 0125.tar.gz
References
Ecartis/Listar Buffer Overflow Vulnerability
References:
References:
- [Ecartis] Security issue with Ecartis/Listar - Please Upgrade. (Peter Losher
- Ecartis Homepage (Noderunner Computing)
- Listar Homepage (Noderunner Computing)