From support@demarc.com Wed Apr 17 17:10:59 2002
From: Demarc Security Support <support@demarc.com>
To: bugtraq@securityfocus.com
Date: Tue, 16 Apr 2002 16:15:26 -0800 (GMT+8)
Subject: Demarc Security Update Advisory

    [The following text is in the "iso-8859-1" character set]
    [Your display is set for the "US-ASCII" character set]
    [Some characters may be displayed incorrectly]

________________________________________________________________________

                 Demarc Security Update Advisory
________________________________________________________________________

Subject:                1.05 login bypass advisory
Date:                   16 April, 2002
________________________________________________________________________

Earlier today we were informed indirectly via a bugtraq posting, of a
security issue in the 1.05 version of our software. While were already
scheduled to release version 1.6 of the software tomorrow, it is advised
that you apply the following official patch to your current installation.
On untrusted networks, the bug could lead to acquisition of
administrative privileges within the Console.

---------

--- demarc              Sun Nov 11 23:48:39 2001
+++ demarc-patched      Tue Apr 16 12:49:56 2002
@@ -6094,6 +6094,7 @@
 ################
 sub check_login{
 my ($session_id) = @_;
+$session_id=~tr/[a-zA-Z0-9]//dc;

 ($session_id) || return;
 &expire_sessions;

----------

This bug is not an issue with version 1.6 which is scheduled for
release on Wednesday 17 April, 2002.  Please visit the new web site,
which will also be launched tomorrow, to download this new version.

If you have any questions related to this bug, please email us at
support@demarc.com