CIA RESEARCH

Alerts

[CIA-1066-Alert] Apache mod_tcl Format String

Summary:

A vulnerability in the mod_tcl Apache server module may allow an attacker to execute arbitrary code on servers running this module.

Technical Details:

A format string vulnerability was discovered in mod_tcl version 1.0 for Apache 2.x servers. The vulnerability results from insecure function calls to the set_var function. Successfully exploiting the vulnerability will result in code executing with the privileges of the http process. In order to exploit the vulnerability the attacker must know the location of at least one server-side script that uses mod_tcl.

Additional technical information is available in the advisory below:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=421

Solution:

Upgrade to mod_tcl version 1.0.1 available from the maintainer.

CVE Reference:

CVE-2006-4154

SecurityTracker Number(s):

1017062

Vendor URL:

Mod_tcl

About the Cenzic CIA Team:

Cenzic Intelligent Analysis (CIA) is Cenzic's research arm that focuses on continuous research for application vulnerabilities. Industry Research, Vulnerability assessment, penetration testing, and security testing - that's what Cenzic Intelligent Analysis Research is all about. Cenzic has dedicated experts whose sole job is to perform ongoing research to find not only common vulnerabilities but also vulnerabilities found in customer applications and make them available to our customers and to the community at large.

About Cenzic:

Cenzic provides Hailstorm® the revolutionary enterprise software suite for automated application security assessment and compliance that allows corporations and government organizations to dramatically improve the security of commercial and custom applications. Hailstorm enables security experts, QA professionals, and developers to work together to assess, analyze, and remediate applications for security vulnerabilities, and verify compliance with security policies. Benefits include reduced security risk and liability, lower development and testing costs, and faster time-to-market. Cenzic's customers are currently in the financial services and e-marketplaces sectors. For more information visit www.cenzic.com or call 1-866-4-CENZIC