The mod_tcl module for the Apache httpd v2.x is a scripting module that allows a TCL developer to create server side script pages in TCL. It is available as a contrib package for several distributions. Remote exploitation of a format string vulnerability in the mod_tcl module for the Apache httpd v2.x could allow attackers to execute arbitrary code in the context of the httpd.
Vulnerable Systems:
* mod_tcl version 1.0 for Apache 2.x
Immune Systems:
* mod_tcl version 1.0.1 for Apache 2.x
Due to programmer error, user supplied data is passed as the format string specifier to several calls to an internally defined variable argument function. The function 'set_var' is declared as follows:
mod_tcl.h:117:void set_var(Tcl_Interp *interp, char *var1,
char *var2, const char *fmt, ...);
Several insecure calls to this function are made through out the code, as seen below:
Vendor response:
The Apache mod_tcl team have addressed this vulnerability with mod_tcl version 1.0.1. It is available from http://tcl.apache.org/mod_tcl/
