Re: Administrivia #5218

[kjkotas () EOS NCSU EDU (kjkotas)]

Yes, a few of the CGI scripts of the Shadow distribution are weak and
easily exploitable. This is not much of a challenge, but true the exploits
have not been published. In one of the Perl CGI scripts, the author even
writes the following:

#
#  Unfortunately, we can't generalize rules for specifying valid tcpdump
#  filters, since a lot of special characters are acceptable. Fortunately,we
#  call the script directly, i.e. no shell and enclose the tcpdump filter
#  in quotes.
#

It pretty much says ';exploit me;'.

The weak scripts that I found all do not have sufficient checking of
command parameters similar to the above.

In particular, I have found the following scripts vulnerable:

pat_match_form.cgi (Version 1.5, 1.6)
mday-search.cgi (Version 1.6)
scan_search.cgi (Version 1.5)
nmap.cgi (Version 1.6)

kjk

On Fri, 21 Jan 2000, Blue Boar wrote:

> I'm told there are unpublished exploits for this package:
>
> http://www.nswc.navy.mil/ISSEC/CID/