Some vulnerabilities have been reported in the mod_tcl module for Apache HTTP server, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerabilities are caused due to format string errors in tcl_cmds.c and tcl_core.c when calling the "set_var()" function with user-supplied input. This can be exploited by sending a specially crafted request containing format specifiers.

Successful exploitation allows execution of arbitrary code, but requires knowledge of the location of a tcl server script configured to use the vulnerable module for processing.

Solution
Update to version 1.0.1.
Further details available to Secunia VIM customers

Provided and/or discovered by
Sparfell

Changelog
Further details available to Secunia VIM customers

Original Advisory
iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=421

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers