|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
Subject: infosrch.cgi vulnerability (IRIX 6.5)
From: rpc (rpc
INETARENA.COM)Date: Thu Mar 02 2000 - 13:12:41 CST
- Next message: Scott Blake: "Distributing Patches in Email (was: RE: EZ Shopper 3.0 shopping cart CGI remote command execution)"
- Previous message: Jonathan Leto: "DNSTools v1.08 has no input validation"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Hi,
InfoSearch is a web-based interface to books, manpages, and relnotes,
distributed by SGI.
No suprises here, no parsing is done on the 'fname' variable before being
passed to man2html. (i.e. when cmd is 'getdoc' and db is 'man').
Also, fname is the _full path_ to the manpage/relnote! I'm sure there's
more vulnerabilities lurking about in this script.
Example:
http://my.really.expensive.sgi.box/cgi-bin/infosrch.cgi?cmd=getdoc&db=man&fname=|/bin/id
Thanks,
--jared <rpcinetarena.com> || <hckz.org>
Security Specialist -- Internet Arena
- Next message: Scott Blake: "Distributing Patches in Email (was: RE: EZ Shopper 3.0 shopping cart CGI remote command execution)"
- Previous message: Jonathan Leto: "DNSTools v1.08 has no input validation"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]