HighCheck or Attack Name: innd vuln
A vulnerability has been identified in the InterNet News (INN) daemon that could allow a remote attacker to gain root access on vulnerable machines. This hole affects all versions up to and including 1.5.1. By sending a specially crafted control message to the victim news server, the process can be tricked into executing arbitrary commands with root privileges. Exploit information for this hole has been made widely available.
This problem affects all versions including and prior to 1.5.1. Users should upgrade to a more recent release of INN, or at the very least apply the patches to the 1.5.1 source tree and rebuild.
CERT Summary CS-97.02, Current activity - attacks on news servers, ftp://info.cert.org/pub/cert_summaries/CS-97.02
CERT Advisory CA-97.08, Vulnerability in innd, http://www.cert.org/advisories/CA-97.08.innd.html
AUSCERT Advisory AA-96.19, INN parsecontrol Vulnerability, ftp://ftp.auscert.org.au/pub/auscert/advisory/AA-96.19.INN.parsecontrol.vul
IBM Emergency Response Service Security Vulnerability Alert ERS-SVA-E01-1997:002.1, Security vulnerability in "innd" (InterNetNews server), http://www-1.ibm.com/services/brs/brspwhub.nsf/advisories
