Mime-Version: |
1.0 |
Sender: |
|
Subject: |
|
From: |
|
Date: |
Wed, 25 May 2005 21:42:42 -0400 |
In-Reply-To: |
|
Content-Type: |
text/plain; charset="us-ascii"; format=flowed |
Reply-To: |
|
Parts/Attachments: |
|
|
Never mind, got it. I had to clean everything out of the folder first.
John
At 06:03 PM 5/25/2005, you wrote:
>On Wed, 25 May 2005 17:45 , Alexander Willman <[log in to unmask]> said:
>
>>Is there a vulnerability in LISTSERV versions 1.8d through 14.3 as the
>>forwarded message below indicates? If so, is there indeed a level set
>>release newer than 14.3 that fixes the problem? The LISTSERV download
>>web site still indicates that 14.3 is the latest version. Thanks.
>
>The latest download should include a fixed wa executable.
>
>Alan Thew
>>
>> Alex
>>
>>
>>-------- Original Message --------
>>Subject: High Risk Vulnerability in L-Soft's LISTSERV Server
>>Date: Wed, 25 May 2005 20:31:29 +0100
>>From: NGSSoftware Insight Security Research <[log in to unmask]>
>>To: [log in to unmask], [log in to unmask],
>>[log in to unmask]
>>
>>Peter Winter-Smith of NGSSoftware has discovered a number of
>>vulnerabilities in L-Soft's LISTSERV list management system. The worst of
>>these carries a high risk rating.
>>
>>Affected versions include:
>>
>>- LISTSERV version 14.3, including LISTSERV Lite and HPO
>>- LISTSERV version 1.8e, including LISTSERV Lite and HPO
>>- LISTSERV version 1.8d, including LISTSERV Lite and HPO
>>
>>Running under Windows and Unix, and OpenVMS AXP.
>>
>>Several of the flaws in question allow remote arbitrary code execution,
>>others allow remote denial of service.
>>
>>This issue has been resolved in the latest release of L-Soft LISTSERV
>>(version 14.3 level set 2005a and above), which may be downloaded from:
>>
>>http://www.lsoft.com/download/listserv.asp
>>http://www.lsoft.com/download/listservlite.asp
>>
>>I (Peter Winter-Smith) would like to extend a special thanks to the
>>support and development teams at L-Soft who were able to address these
>>issues, from reporting to published fix, in well under a week.
>>
>>NGSSoftware are going to withhold details of this flaw for three months.
>>Full details will be published on the 25th August 2005. This three month
>>window will allow users of L-Soft's LISTSERV the time needed to apply the
>>patch before the details are released to the general public. This
>>reflects NGSSoftware's approach to responsible disclosure.
>>
>>NGSSoftware Insight Security Research
>>http://www.ngssoftware.com
>>http://www.databasesecurity.com/
>>http://www.nextgenss.com/
>>+44(0)208 401 0070
|
|
|