Avi Alkalay man-cgi topic Variable Arbitrary Command Execution

2005-09-12T00:06:15
ID OSVDB:19519
Type osvdb
Reporter Sullo(sullo@cirt.net)
Modified 2005-09-12T00:06:15

Description

Vulnerability Description

man-cgi contains a flaw that may allow a malicious user to execute arbitrary commands on the server. The issue is triggered when a semi-colon is entered into the 'topic' variable. This flaw may lead to a loss of Confidentiality, Integrity and/or Availability.

Solution Description

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Short Description

man-cgi contains a flaw that may allow a malicious user to execute arbitrary commands on the server. The issue is triggered when a semi-colon is entered into the 'topic' variable. This flaw may lead to a loss of Confidentiality, Integrity and/or Availability.

Manual Testing Notes

http://[victim]/cgi-bin/man-cgi?section=0&topic=ls;touch%20/tmp/test

References:

Vendor URL: http://www.alkalay.net/software/ Secunia Advisory ID:16887 Related OSVDB ID: 19520 Related OSVDB ID: 19521 Related OSVDB ID: 19522 Related OSVDB ID: 19879 Other Advisory URL: http://www.cirt.net/advisories/alkalay.shtml CVE-2005-3094