----------------------------------------------------------------------

Want to work within IT-Security?

Secunia is expanding its team of highly skilled security experts.
We will help with relocation and obtaining a work permit.

Currently the following type of positions are available:
http://secunia.com/hardcore_disassembler_and_reverse_engineer/

----------------------------------------------------------------------

TITLE:
Apache HTTP Server mod_tcl Format String Vulnerabilities

SECUNIA ADVISORY ID:
SA22458

VERIFY ADVISORY:
http://secunia.com/advisories/22458/

CRITICAL:
Highly critical

IMPACT:
System access

WHERE:
>From remote

SOFTWARE:
mod_tcl 1.x
http://secunia.com/product/12306/

DESCRIPTION:
Some vulnerabilities have been reported in the mod_tcl module for
Apache HTTP server, which can be exploited by malicious people to
compromise a vulnerable system.

The vulnerabilities are caused due to format string errors in
tcl_cmds.c and tcl_core.c when calling the "set_var()" function with
user-supplied input. This can be exploited by sending a specially
crafted request containing format specifiers.

Successful exploitation allows execution of arbitrary code, but
requires knowledge of the location of a tcl server script configured
to use the vulnerable module for processing.

SOLUTION:
Update to version 1.0.1.
http://tcl.apache.org/mod_tcl/

PROVIDED AND/OR DISCOVERED BY:
Sparfell

ORIGINAL ADVISORY:
iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=421

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------