6092168 2001-02-13 18:51 +0000  /32 rader/ Stephen Turner <S.R.E.Turner@STATSLAB.CAM.AC.UK>
Sänt av: joel@lysator.liu.se
Importerad: 2001-02-14  00:29  av Brevbäraren (som är implementerad i) Python
Extern mottagare: BUGTRAQ@SECURITYFOCUS.COM
Externa svar till: sret1@cam.ac.uk
Mottagare: Bugtraq (import) <15424>
Ärende: Security advisory for analog
------------------------------------------------------------
From: Stephen Turner <S.R.E.Turner@STATSLAB.CAM.AC.UK>
To: BUGTRAQ@SECURITYFOCUS.COM
Message-ID: <Pine.LNX.3.96.1010213184923.2606C-100000@gamma.statslab.cam.ac.uk>

SECURITY ADVISORY                                   13th February 2001
----------------------------------------------------------------------
Program: analog (logfile analysis program)
Versions: all versions except 4.16 and 4.90beta3
Operating systems: all
----------------------------------------------------------------------
There is a buffer overflow bug in all versions of analog released
prior to today. A malicious user could use an ALIAS command to
construct very long strings which were not checked for length.

This bug is particularly dangerous if the form interface (which allows
unknown users to run the program via a CGI script) has been installed.

This bug was discovered by the program author, and there is no known
exploit. However, users are advised to upgrade to one of the two safe
versions immediately, especially if they have installed the form
interface. The URL is http://www.analog.cx/

I apologise for the inconvenience.
                                                        Stephen Turner

--
Stephen Turner               http://www.statslab.cam.ac.uk/~sret1/
  Statistical Laboratory, Wilberforce Road, Cambridge, CB3 0WB, England
  "Your account can only be used for a single internet session at any one
   time and for no more than 24 hours in any one day." (NTL terms of use)
(6092168) ------------------------------------------