-----BEGIN PGP SIGNED MESSAGE----- =============================================================================== Author/Source : Niels den Otter Index : S-97-28 Distribution : World Page : 1 Classification: External Version: 1 Subject : Selena Sol's Guestbook vulnerable Date : 28-Apr-97 =============================================================================== By courtesy of Selena Sol and CERT Coordination Center we received the following information. In CERT Coordination Center Vendor-Initiated Bulletin VB-97.02 Selena Sol reports a vulnerability in Selena Sol's Guestbook script. This vulnerability allows remote users to execute arbitrary commands on the web server as the uid of the httpd daemon. This advisory provides the recommendation to update the guestbook to the current version or implement the provided steps as appropriate to the version that is used. CERT-NL recommends to update the guestbook to the current version. All CERT Coordination Center advisories and bulletins are mirrored by CERT-NL. The specific URL for this case is: More information about the CERT-NL mirror and notifier services is contained in News items N-95-01 (notifier) and N-95-02 (CERT mirror), both present on ============================================================================== CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet is the Dutch network for educational, research and related institutes. CERT-NL is a member of the Forum of Incident Response and Security Teams (FIRST). All CERT-NL material is available under: In case of computer or network security problems please contact your local CERT/security-team or CERT-NL (if your institute is NOT a SURFnet customer please address the appropriate (local) CERT/security-team). CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer, i.e. UTC+0100 in winter and UTC+0200 in summer (DST). Email: cert-nl@surfnet.nl Phone: +31 302 305 305 Fax: +31 302 305 329 Snailmail: SURFnet bv Attn. CERT-NL P.O. Box 19035 NL - 3501 DA UTRECHT The Netherlands A 7 * 24 hours phone number is available to SURFnet SSC's and FIRST members on request. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBM2SJbUU5nQkWIq1FAQHPLAP+K6ZvtVMgWz6sUVzh0dfkMaLkzWdA8jR+ ZqP3ewgfPBfGZW6+gvdGB/0HprYD97GcxCcQprTReOmwNDqa3nrZJtJz+ZoXimv8 6KcQpmF8aBKK0mxOf+MHvUotVAzVzMYvS8Jg/io57oj1dGzrNhk2bsqX/L4m/7/5 5e0CBS3yhoA= =x1ae -----END PGP SIGNATURE-----