oops-1.4.22 vulnerability
oops-1.4.22 has a buffer overflow vulnerability mentioned by the bugtraq
with the ID of 2099, but it is fixed now in the newer version.
Please upgrade to this newer, 1.5.1 version that is currently in the
upload queue at samosa.
The related information from the http://www.securityfocus.com/ :
/* cut */
Oops is a freely available proxy server package, written by Igor Khasilev.
A problem exists in the package which could allow for the arbitrary
execution of code.
The problem occurs in the ftp_utils section of the program. It is possible
to make a request with numerous quotation marks (") in the request, which
are later translated to the html tag """. The translation of this
character makes it possible to overflow and potentially execute code on
the stack. This makes it possible for a malicious user to execute code
with the privileges of the user the proxy server is operating as.
/* cut */
--
VWOL
Tamas SZERB <toma@rulez.org>
GPG public key: http://alabama.inf.elte.hu/~toma/gpgkey-toma.asc
Reply to: