PT-2002-1257 · Mandrake · Webalizer

Published 2002-04-18 · Updated 2017-07-11 · CVE-2002-0180

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Webalizer versions 2.01 through 2.06

Description A buffer overflow issue exists when Webalizer is configured to use reverse DNS lookups. This allows remote attackers to execute arbitrary code by connecting to the monitored web server from an IP address that resolves to a long hostname.

Recommendations For Webalizer versions 2.01 through 2.06, consider disabling the reverse DNS lookup feature as a temporary workaround until a patch is available. Restrict access to the monitored web server to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-0180

Affected Products

Webalizer

References · 7

• http://mrunix.net/webalizer/news.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0180 · Security Note
• http://kb.cert.org/vuls/id/582923 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0180 · Note
• http://securityfocus.com/bid/4504 · Note
• http://marc.info/?l=bugtraq&m=101888467527673&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8837 · Note