Multiple OpenVMS WASD HTTP Server Vulnerabilities

Bugtraq ID:	5811
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Sep 26 2002 12:00AM
Updated:	Sep 26 2002 12:00AM
Credit:	Discovery of these issues is credited to Jean-loup Gailly <[email protected]>.
Vulnerable:	WASD WASD HTTP Server 8.0 WASD WASD HTTP Server 7.2.3 WASD WASD HTTP Server 7.2.2 WASD WASD HTTP Server 7.2.1 WASD WASD HTTP Server 7.2 WASD WASD HTTP Server 7.1
Not Vulnerable:	WASD WASD HTTP Server 8.1 WASD WASD HTTP Server 8.0.1 WASD WASD HTTP Server 7.2.4

Multiple OpenVMS WASD HTTP Server Vulnerabilities

Multiple vulnerabilities have been reported in WASD HTTP Server for OpenVMS. The consequences of successful exploitation of these issues may range from information disclosure to varying degrees of remote compromise.

Multiple OpenVMS WASD HTTP Server Vulnerabilities

Most, if not all, of these issues may be exploited via a web browser.

Multiple OpenVMS WASD HTTP Server Vulnerabilities

Solution:
The vendor has released fixed versions which address these issues. Administrators are advised to upgrade.

Those using versions prior to 7.2 are advised to upgrade to at least 7.2 and then apply the relevant fixes.


WASD WASD HTTP Server 7.2

• WASD WASD 7.24 Fix Kit
  http://wasd.vsm.com.au/wasd/

WASD WASD HTTP Server 7.2.1

• WASD WASD 7.24 Fix Kit
  http://wasd.vsm.com.au/wasd/

WASD WASD HTTP Server 7.2.2

• WASD WASD 7.24 Fix Kit
  http://wasd.vsm.com.au/wasd/

WASD WASD HTTP Server 7.2.3

• WASD WASD 7.24 Fix Kit
  http://wasd.vsm.com.au/wasd/

WASD WASD HTTP Server 8.0

• WASD WASD 8.01 Fix Kit
  http://wasd.vsm.com.au/wasd/

Multiple OpenVMS WASD HTTP Server Vulnerabilities

References:

• WASD Package Security Advisory (WASD)