| VID |
21228 |
| Severity |
40 |
| Port |
80, ... |
| Protocol |
TCP |
| Class |
CGI |
| Detailed Description |
An UNIX CGI script interpreter file was found in a CGI bin directory on the Web server. A common Web server misconfiguration is to put shell interpreters (such as sh, csh, ksh, bash, etc.) in the CGI bin directory (like /cgi-bin/, /scripts/). Also, some early Web server documentation stated that CGI script interpreters (such as perl, java, python, etc.) should be placed in the CGI bin directory.
Placement of shell interpreters and CGI script interpreters in the CGI bin directory could allow a remote attacker to execute arbitrary commands through the interpreters. By sending a specially-crafted HTTP request, a remote attacker could cause these shells to execute arbitrary commands on the server.
* References:
http://www.cert.org/advisories/CA-1996-11.html
* Platforms Affected:
Any HTTP server Any version
Unix Any version
Linux Any version |
| Recommendation |
If any CGI programs rely on CGI script interpreter access, move the CGI script interpreter outside the www root, and modify the CGI programs to look for the interpreter in the new location.
-- AND --
If no programs use the CGI script interpreter, remove it from the CGI bin directory. |
| Related URL |
CVE-1999-0509 (CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
146 (ISS) |
|
