MBone Session Directory Manager Package SDR Vulnerability

Bugtraq ID:	492
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 28 1999 12:00AM
Updated:	Jun 28 1999 12:00AM
Credit:	First revealed in CERT Vulnerability Note VN-99-03 on June 28, 1999.
Vulnerable:	University College London SDR 2.6.1
Not Vulnerable:	University College London SDR 2.6.3

MBone Session Directory Manager Package SDR Vulnerability

SDR is a session directory tool designed to allow the advertisement and joining of multicast conferences on the Mbone. It is currently maintained by the computer science department of University College London. On Monday June 28, CERT released a Vulnerability Note exposing a serious vulnerability in SDR versions below release 2.6.3. The vulnerability allows for arbitrary code to be executed on the vulnerable machine with the privileges of the SDR uid.

MBone Session Directory Manager Package SDR Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

MBone Session Directory Manager Package SDR Vulnerability

Solution:
Users are advised to immediately upgrade to SDR release 2.6.3 available at the following location:

http://www-mice.cs.ucl.ac.uk/multimedia/software/