Re: Administrivia #5218

[lamont () ICOPYRIGHT COM (Granquist, Lamont)]

If someone can access your analysis machine and run these scripts with
their own parameters, then you've got a huge problem above and beyond any
vulnerabilities in these scripts.

On Sat, 22 Jan 2000, kjkotas wrote:
> Yes, a few of the CGI scripts of the Shadow distribution are weak and
> easily exploitable. This is not much of a challenge, but true the exploits
> have not been published. In one of the Perl CGI scripts, the author even
> writes the following:
>
> #
> #  Unfortunately, we can't generalize rules for specifying valid tcpdump
> #  filters, since a lot of special characters are acceptable. Fortunately,we
> #  call the script directly, i.e. no shell and enclose the tcpdump filter
> #  in quotes.
> #
>
> It pretty much says ';exploit me;'.
>
> The weak scripts that I found all do not have sufficient checking of
> command parameters similar to the above.
>
> In particular, I have found the following scripts vulnerable:
>
> pat_match_form.cgi (Version 1.5, 1.6)
> mday-search.cgi (Version 1.6)
> scan_search.cgi (Version 1.5)
> nmap.cgi (Version 1.6)
>
>
> kjk
>
> On Fri, 21 Jan 2000, Blue Boar wrote:
>
> > I'm told there are unpublished exploits for this package:
> >
> > http://www.nswc.navy.mil/ISSEC/CID/