[1][USEMAP:frame_r1_c1.gif]   [frame_r1_c3.gif]
   [2]Japanese
   
   SNS Advisory
   [title2_r1_c1.gif]
   
   [3][GoIndex.gif] [4][GoBack.gif] 
   
                                     14
                                      
   [5][GoNext.gif] [6]Japanese Edition
   
     SNS Advisory No.14
     Netscape Enterprise Server 3.6 SP1 Buffer Overflow Vulnerability
     
   Problem first discovered: 14 Jul 2000
   Published: 17 Jul 2000
   Last Updated: 17 Jul 2000
     _________________________________________________________________
   
   Overview:
   
     An exploitable buffer overflow vulnerability was found in Netscape
     Emterprise Server 3.6 SP1, which allows attackers to execute
     arbitrary commands.
     
                                 [14_1.gif]
                            Fig1: Target Machine
                                 [14_2.gif]
                                 Fig2: Tool
       (note: " [yen.gif] " means " [back_slash.gif] "(back slash) in
                                 ASCII code)
     
                                 [14_3.gif]
                    Fig3: Execution of arbitrary command
                  (notepad.exe is excuted in this example)
     
     Status of fixes:
     
     It is possible to obtain Netscape Emterprise Server 3.6 SP3 at the
     following site.
     
     [7]http://www.iplanet.com/downloads/download/0125.html
     
     However, Netscape Enterprise Server 3.6 is no longer a shipping
     version. You can download a new application, iPlanet Web Server,
     Enterprise Edition 4.1, from:
     
     [8]http://www.iplanet.com/downloads/download/0110.html
     
     Disclaimer:
     
     All information in these advisories are subject to change without
     any advanced notices neither mutual consensus, and each of them is
     released as it is. LAC Co.,Ltd. is not responsible for any risks of
     occurrences caused by applying those information.
     _________________________________________________________________
   
     Copyright(c) 1995-2002 Little eArth Corporation

References

   1. LYNXIMGMAP:http://www.lac.co.jp/security/english/snsadv_e/14_e.html#r1_c1Map
   2. http://www.lac.co.jp/security/index.html
   3. http://www.lac.co.jp/security/english/snsadv_e/index.html
   4. http://www.lac.co.jp/security/english/snsadv_e/13_e.html
   5. http://www.lac.co.jp/security/english/snsadv_e/15_e.html
   6. http://www.lac.co.jp/security/intelligence/SNSAdvisory/14.html
   7. http://www.iplanet.com/downloads/download/0125.html
   8. http://www.iplanet.com/downloads/download/0110.html