Two vulnerabilities have been reported in OPeNDAP BES Software, which potentially can be exploited by malicious people to gain knowledge of system information or to compromise a vulnerable system.

1) Data in compressed files is not properly sanitised before being stored in the server. This can be exploited to e.g. execute arbitrary commands on the server by uploading a specially crafted compressed file.

2) The vulnerability is caused due to an unspecified error and can be exploited to enumerate files on the system.

The vulnerabilities are reported in versions prior to 3.5.0.

Solution
Update to BES Software version 3.5.0 / Hyrax version 1.2.1.

Provided and/or discovered by
Discovered by NCIRT labs and reported via US-CERT.

Changelog
Further details available to Secunia VIM customers

Original Advisory
OPeNDAP:
http://www.opendap.org/security.html
http://www.opendap.org/download/BES.html

US-CERT VU#659148:
http://www.kb.cert.org/vuls/id/659148

US-CERT VU#671028:
http://www.kb.cert.org/vuls/id/671028

Deep Links
Links available to Secunia VIM customers