Avenger's News System Remote Command Execution Vulnerability
BID:4149
Info
Avenger's News System Remote Command Execution Vulnerability
| Bugtraq ID: | 4149 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-0306 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 21 2002 12:00AM |
| Updated: | Jul 11 2009 10:56AM |
| Credit: | This issue was submitted to BugTraq on February 21st, 2002 by "b0iler _" <[email protected]>. |
| Vulnerable: |
Avenger's News System Avenger's News System 2.1 1 Avenger's News System Avenger's News System 2.0 1 |
| Not Vulnerable: | |
Discussion
Avenger's News System Remote Command Execution Vulnerability
Avenger's News System (ANS) is a simple form-based web site management tool written in Perl. It will run on most Unix and Linux variants.
ANS does not filter shell metacharacters from web requests, making it prone to remote command execution attacks. As a result, a remote attacker may execute commands on the underlying shell of the host running the vulnerable software. Commands will be executed with the privileges of the webserver process.
Successful exploitation of this vulnerability may allow a remote attacker to gain local access to the host running the vulnerable software.
Avenger's News System (ANS) is a simple form-based web site management tool written in Perl. It will run on most Unix and Linux variants.
ANS does not filter shell metacharacters from web requests, making it prone to remote command execution attacks. As a result, a remote attacker may execute commands on the underlying shell of the host running the vulnerable software. Commands will be executed with the privileges of the webserver process.
Successful exploitation of this vulnerability may allow a remote attacker to gain local access to the host running the vulnerable software.
Exploit / POC
Avenger's News System Remote Command Execution Vulnerability
This issue may be exploited with a web browser.
This issue may be exploited with a web browser.
Solution / Fix
Avenger's News System Remote Command Execution Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Avenger's News System Remote Command Execution Vulnerability
References:
References:
- Avenger's News System Homepage (Avenger's News System)