Specifications

Matt Wright FormMail Environmental Variables Disclosure Vulnerability

Released May 10, 2000

Affects Matt Wright FormMail 1.6

Reference http://www.securityfocus.com/bid/1187

Problem

- An unauthorized remote user is capable of obtaining CGI environmental variable information from

a web server running Matt Wright FormMail by requesting a specially formed URL that specifies

the email address to send the details to.

- This is accomplished by specifying a particular CGI environmental variable such as PATH,

DOCUMENT_ROOT, SERVER_PORT in the specially formed URL which will email the results to

the address given. The information obtained could possibly be used to assist in a future attack.

SAFER

- Unofficial patch is available.

Microsoft SQL Server Xp_sprintf buffer overflow

Released May 09, 2000

Affects Microsoft SQL Server 6.5, 6.0

Reference http://www.securityfocus.com/bid/1204

Problem

- In versions of SQL Server earlier than Release 6.5, Service Pack 5 the extended stored procedure

xp_sprintf can be exploited using buffer overflows.

- An attacker can use xp_sprintf to crash the server or to possibly gain administrator privileges on

the system running SQL Server.

SAFER

- This issue is resolved in version of Microsoft SQL Server greater than 6.5 SP5.

NetStructure 7180 Remote Backdoor Vulnerability

Released May 08, 2000

Affects Intel Corporation NetStructure 7180.0

Reference http://www.securityfocus.com/bid/1183

Problem

- This Internet equipment is designed for businesses with multiple Web site locations, routing traffic

to the best available site from a single URL management. Certain revisions of this package have

two undocumented supervisor passwords. These passwords are derived from is the ethernet

address of the public interface which under default installs is available via a default passworded

SNMP daemon.

- These passwords can be utilized via the admin console locally (via a serial interface) or remotely if

the machine has been deployed with a modem for remote accessory allows telnet access. It

should be noted that configuration over telnet is preferred in the user documentation. With these

passwords an intruder gains shell access to the underlying UNIX system and may sniff traffic

among other things.

SAFER

- Intel has provided a patch for this issue.