Specifications

L-Soft Listserv 1.8 Web Archives Buffer Overflow Vulnerability

Released May 03, 2000

Affects L-Soft Listserv 1.8

Reference http://www.securityfocus.com/bid/1167

Problem

- The Web Archive component of L-Soft Listserv contains unchecked buffer code exploitable by

sending specially crafted requests to the Web Archive.

- This weakness will allow execution of arbitrary code by remote attackers.

SAFER

- L-Soft has created an update to ListServ to address this issue.

UltraBoard Directory Traversal Vulnerability

Released May 03, 2000

Affects UltraScripts UltraBoard 1.6

Reference http://www.securityfocus.com/bid/1164

Problem

- UltraBoard 1.6 (and possibly all 1.x versions) is vulnerable to a directory traversal attack that will

allow any remote browser to download any file that the webserver has read access to.

- On Windows installations, the file must reside on the same logical drive as the webroot. In all

cases, the attacker must know the filename and relative path from the webroot.

- This is accomplished through a combination of the '../' string and the usage of a null byte (x00) in

the variables passed to the UltraBoard CGI.

SAFER

- There is a new version of UltraBoard available (UltraBoard 2000) that may not be vulnerable in

this manner. This is untested.

AppleShare IP 6.x Invalid Range Request Vulnerability

Released May 02, 2000

Affects Apple AppleShare IP 6.3, 6.2, 6.1

Reference http://www.securityfocus.com/bid/1162

Problem

- Requesting a URL with a specified range exceeding the physical limit of the file will cause the Web

Server in AppleShare IP to return an extra 32 KB of information taken from RAM.

- The additional data will appear appended to the file requested and may contain sensitive

information.

SAFER

- Apple Computer has released an upgrade which rectifies this issue.

Microsoft Windows 9x NetBIOS NULL Name Vulnerability

Released May 02, 2000

Affects Microsoft Windows 98, 95

Reference http://www.securityfocus.com/bid/1163

Problem

- Unpredictable results, including system crashes, lock-ups, reboots, and loss of network

connectivity, can occur in Windows 95/98 if a NetBIOS session packet is received with the source

host name set to NULL.

SAFER

- No patches have been released yet.