PT-2006-2081 · L Soft+1 · Listserv Lite+2

Peter Winter-Smith · Published 2006-03-07 · Updated 2018-10-18 · CVE-2006-1044

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LISTSERV versions 14.3 through 14.4

Description The issue is related to multiple buffer overflows in the web archive interface of LISTSERV, including LISTSERV Lite and HPO. This allows remote attackers to execute arbitrary code via unknown attack vectors related to the WA CGI.

Recommendations For LISTSERV versions 14.3 through 14.4, consider disabling the web archive interface until a patch is available. Restrict access to the WA CGI to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-1044

Affected Products

Hpo

Listserv

Listserv Lite

References · 11

• http://lsoft.com/manuals/1.8e/relnotes/LISTSERV14.5-Release-Notes.html#wasecurityalert · Patch
• http://securityfocus.com/bid/16951 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-1044 · Security Note
• http://securitytracker.com/id?1015722 · Vendor Advisory
• http://secunia.com/advisories/19106 · Note
• http://ngssoftware.com/advisories/listserv_3.txt · Note
• http://vupen.com/english/advisories/2006/0824 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1044 · Note
• http://kb.cert.org/vuls/id/841132 · Note
• http://securityfocus.com/archive/1/426770/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25168 · Note