Has anyone verified this vulnerability?? Hopefully these vulnerability
alert type companies will at least verify the vulnerability before release
it to the public.
/chhers
/m
Subject: eSecurityOnline.com Free Vulnerability Alert 3091 - TIS FWTK x-gw
format string vulnerability
Date: Thu, 2 Nov 2000 12:23:45 -0600
:
:
On Nov 2, 2000 the eSecurityOnline.com Vulnerability Service
research team identified a vulnerability affecting a technology
for which you have enabled vulnerability alerts. The details of
the vulnerability follow:
TIS FWTK x-gw format string vulnerability
Description:
TIS FWTK is vulnerable to a flaw that allows a remote attacker
to execute arbitrary code. The FireWall ToolKit (FWTK) is a set
of proxies which you can use to build your own firewall. The
x-gw component contains a format string vulnerability when no
input validity checks are made on the user input for a X-Window
display.
Impact:
A remote attacker can execute arbitrary code.
Affected Technologies:
TIS FWTK 2.1
Recommended Fix:
Patch:
--- x-gw/pmsg.c.orig Mon Oct 23 13:21:26 2000
+++
x-gw/pmsg.c Mon Oct 23 13:22:36 2000
@@ -37,9 +37,9
@@
buf[sizeof(buf)-1] = '\0';
}
- if( uselog )
log(
LLEV, buf );
+ if( uselog ) syslog( LLEV, "%s", buf );
else
{
- fprintf( stderr, buf );
+ fprintf( stderr, "%s", buf
);
fflush(stderr);
}
}
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
