CGIHTML Form Data File Corruption Vulnerability
BID:6550
Info
CGIHTML Form Data File Corruption Vulnerability
| Bugtraq ID: | 6550 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 07 2003 12:00AM |
| Updated: | Jan 07 2003 12:00AM |
| Credit: | Discovery of this issue is credited to Chris Leishman <[email protected]>. |
| Vulnerable: |
Eekim cgihtml 1.69 |
| Not Vulnerable: | |
Discussion
CGIHTML Form Data File Corruption Vulnerability
When handling uploaded form-data, cgihtml creates a temporary file to store this data in /tmp or another user-specified directory. The software uses the client supplied filename when creating the temporary file. If the client supplies a malicious filename (such as one containing directory traversal sequences), it may be able to overwrite local files on the system hosting the vulnerable software.
When handling uploaded form-data, cgihtml creates a temporary file to store this data in /tmp or another user-specified directory. The software uses the client supplied filename when creating the temporary file. If the client supplies a malicious filename (such as one containing directory traversal sequences), it may be able to overwrite local files on the system hosting the vulnerable software.
Solution / Fix
CGIHTML Form Data File Corruption Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
CGIHTML Form Data File Corruption Vulnerability
References:
References:
- Multiple cgihtml vulnerabilities (Chris Leishman