Upgrade your software; it is not current.
> The only version I tried this on is 2.4 PL24 (Linux), which I think is the
> latest one.
2.4 PL25 came out in December, 1995. It may be found at:
ftp://ftp.myxa.com/pub/elm/elm2.4.tar.Z
2.4 PL25 is still the current release. 2.5 is in beta test.
The CERT vendor bulletins for this bug may be found at:
ftp://info.cert.org/pub/cert_bulletins/VB-95:10.elm
ftp://info.cert.org/pub/cert_bulletins/VB-95:10a.elm
yours,
Larry Schwimmer
schwim@cyclone.stanford.edu