Secunia

Multiple vulnerabilities have been identified in Citadel/UX, which can be exploited by malicious people to gain high privileges, cause a DoS (Denial of Service) on a vulnerable system or compromise it.

1) The authentication token for the higher privileged "internal program" is generated in a predictable way, because the seed is based on the process id (pid). A malicious person, who is able to correctly guess the pid, may therefore be able to gain privileges as an "internal program".

2) There are some boundary errors in the functions used for importing configuration options. This can be exploited to cause a buffer overflow allowing execution of arbitrary code on the system.

Since the affected functions only can be used by an "internal program", successful exploitation requires that a person has gained these privileges (eg. by exploiting the first vulnerability).

3) Missing size restrictions of a user's biography file can be exploited to consume all available disk space.

The vulnerabilities have been reported in version 6.07. However, prior versions may also be affected.

NOTE: See original advisory for more detailed information and exploits.

Solution
Update to version 6.08:
Further details available in Customer Area

Provided and/or discovered by
Carl Livitt and br00t.

Original Advisory
http://lists.insecure.org/lists/fulldisclosure/2003/Jul/att-0377/CLIVITT-2003-4__Citadel_.txt

Deep Links
Links available in Customer Area