Vulnerability Assessment & Network Security Forums



If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important.  If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery.


Home >> Browse Vulnerability Assessment Database >> CGI abuses >> Sysinfo name Parameter Code Execution Vulnerability


Vulnerability Assessment Details

Sysinfo name Parameter Code Execution Vulnerability

Vulnerability Assessment Summary
Tries to execute arbitrary code using Sysinfo

Detailed Explanation for this Vulnerability Assessment

Summary :

The remote web server contains a Perl script that is susceptible to
arbitrary command execution attacks.

Description :

The remote host is running Sysinfo, a web-based system monitor.

The version of Sysinfo installed on the remote host fails to sanitize
user-supplied input to the 'name' parameter before passing it to a
shell for execution. An unauthenticated attacker may be able to
exploit this issue to execute arbitrary shell commands on the remote
host subject to the rights of the web server user id.

See also :

http://downloads.securityfocus.com/vulnerabilities/exploits/sysinfo_poc

Solution :

Upgrade to Sysinfo version 2.25 or later.

Network Security Threat Level:

High / CVSS Base Score : 7
(AV:R/AC:L/Au:NR/C:P/A:P/I:P/B:N)

Networks Security ID: 17523

Vulnerability Assessment Copyright: This script is Copyright (C) 2006 Tenable Network Security

Cables, Connectors


Seagate 10TB 7200RPM 12Gbps 3.5in SAS Hard Drive ST10000NM096 picture

Seagate 10TB 7200RPM 12Gbps 3.5in SAS Hard Drive ST10000NM096

$79.99



Seagate Exos 7E10 ST2000NM000B 2TB 7200RPM SATA 6.0Gb/s 3.5

Seagate Exos 7E10 ST2000NM000B 2TB 7200RPM SATA 6.0Gb/s 3.5" Internal Hard Drive

$29.99



Dell ST2000NX0403 2T SATA 2.5 inch 7.2K CK3MN server hard drive picture

Dell ST2000NX0403 2T SATA 2.5 inch 7.2K CK3MN server hard drive

$45.00



HGST Ultrastar HE10 HUH721010ALE600 10TB SATA 6Gb/s 7200RPM 3.5

HGST Ultrastar HE10 HUH721010ALE600 10TB SATA 6Gb/s 7200RPM 3.5" Enterprise HDD

$69.99



HGST Ultrastar DC HC520 12TB SATA 6Gb 256MB 3.5

HGST Ultrastar DC HC520 12TB SATA 6Gb 256MB 3.5" Enterprise HDD- HUH721212ALE601

$89.99



Seagate ST12000NM0127 12TB 256MB 7200RPM 3.5

Seagate ST12000NM0127 12TB 256MB 7200RPM 3.5" SATA 6.0Gb/s Enterprise Hard Drive

$93.88



Seagate ST12000NM0127 12TB SATA 6Gb/s 256MB 7200RPM 3.5

Seagate ST12000NM0127 12TB SATA 6Gb/s 256MB 7200RPM 3.5" Enterprise Hard Drive

$99.99



SEAGATE ST4000NM0023 HARD DRIVE 3.5

SEAGATE ST4000NM0023 HARD DRIVE 3.5" SAS 4TB HDD

$16.99



Western Digital WD10JUCT 1TB 2.5

Western Digital WD10JUCT 1TB 2.5" SATA 3Gb/s 5400 RPM 16MB Laptop Hard Drive

$17.98



HGST 3.5 Internal Hard Drive 3TB 7200rpm 0F12470 picture

HGST 3.5 Internal Hard Drive 3TB 7200rpm 0F12470

$30.00



Discussions

No Discussions have been posted on this vulnerability.