infosrch.cgi vulnerability (IRIX 6.5)

From: rpc (rpcat_private)
Date: Thu Mar 02 2000 - 11:12:41 PST

Next message: Scott Blake: "Distributing Patches in Email (was: RE: EZ Shopper 3.0 shopping"

Previous message: Joe Shaw: "Re: [ Hackerslab bug_paper ] Linux dump buffer overflow"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi,

InfoSearch is a web-based interface to books, manpages, and relnotes,
distributed by SGI.

No suprises here, no parsing is done on the 'fname' variable before being
passed to man2html. (i.e. when cmd is 'getdoc' and db is 'man').

Also, fname is the _full path_ to the manpage/relnote! I'm sure there's
more vulnerabilities lurking about in this script.

Example:
http://my.really.expensive.sgi.box/cgi-bin/infosrch.cgi?cmd=getdoc&db=man&fname=|/bin/id

Thanks,
--jared <rpcat_private> || <hat_private>
Security Specialist -- Internet Arena

Next message: Scott Blake: "Distributing Patches in Email (was: RE: EZ Shopper 3.0 shopping"
Previous message: Joe Shaw: "Re: [ Hackerslab bug_paper ] Linux dump buffer overflow"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:38:43 PDT