Test Kennung:	1.3.6.1.4.1.25623.1.0.10784
Kategorie:	CGI abuses
Titel:	ht://Dig's htsearch potential exposure/dos
Zusammenfassung:	NOSUMMARY
Beschreibung:	Description: The remote CGI htsearch allows the user to supply his own configuration file using the '-c' switch, as in : /cgi-bin/htsearch?-c/some/config/file This file is not displayed by htsearch. However, if an attacker manages to upload a configuration file to the remote server, it may make htsearch read arbitrary files on the remote host. An attacker may also use this flaw to exhaust the resources on the remote host by specifying /dev/zero as a configuration file. Solution: Upgrade to ht://Dig 3.1.6 or newer (http://www.htdig.org/files/snapshots/) Risk factor : High
Querverweis:	BugTraq ID: 3410 Common Vulnerability Exposure (CVE) ID: CVE-2001-0834 http://www.securityfocus.com/bid/3410 Bugtraq: 20011007 Re: Bug found in ht://Dig htsearch CGI (Google Search) http://marc.info/?l=bugtraq&m=100260195401753&w=2 Caldera Security Advisory: CSSA-2001-035.0 http://www.calderasystems.com/support/security/advisories/CSSA-2001-035.0.txt Conectiva Linux advisory: CLA-2001:429 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000429 Debian Security Information: DSA-080 (Google Search) http://www.debian.org/security/2001/dsa-080 http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-083.php3 http://sourceforge.net/tracker/index.php?func=detail&aid=458013&group_id=4593&atid=104593 http://www.redhat.com/support/errata/RHSA-2001-139.html SuSE Security Announcement: SuSE-SA:2001:035 (Google Search) http://www.novell.com/linux/security/advisories/2001_035_htdig_txt.html XForce ISS Database: htdig-htsearch-infinite-loop(7262) https://exchange.xforce.ibmcloud.com/vulnerabilities/7262 XForce ISS Database: htdig-htsearch-retrieve-files(7263) https://exchange.xforce.ibmcloud.com/vulnerabilities/7263
Copyright	Copyright (C) 2001 Renaud Deraison

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.