Short Name |
HTTP:CGI:INFOSRCH-REMOTE-EXEC |
---|---|
Severity |
Minor |
Recommended |
No |
Category |
HTTP |
Keywords |
IRIX InfoSearch fname Remote Execution |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
This signature detects attempts to exploit a known vulnerability in the infosrch.cgi script. Attackers can execute commands on the Web server.
The InfoSearch package converts man pages and other documentation into HTML web content. The search form uses infosrch.cgi which does not properly parse user input in the 'fname' variable, allowing commands to be executed at the webserver privilege level by remote web users.