Signature Detail
Short Name |
HTTP:CGI:REF-CMD-INJECT |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
cmd inject ref |
Release Date |
2005/09/09 |
Update Number |
1213 |
Supported Platforms |
di-5.3+, idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Generic Command Execution Attempt in Referer
This signature detects generic command execution embedded in HTTP referers. Attackers can embed commands in an HTTP URL to exploit simple HTTP applications.
Extended Description
Netscape's iPlanet iCal application is a network based calendar service built for deployment in organizations which require a centralized calendar system. Certain versions of iCal ship with a vulnerability introduced in the installation process which will allow malicious local users to gain root on the system. During the installation process a large number of files are left world readable and writable. One such file, /opt/SUNWicsrv/cal/bin/iplncal.sh is designed to be run at startup as root and is world writable by default. This allows users to modify the contents of this startup script and have it executed at boot up time or whenever the machine is re-initialized.
Affected Products
- Netscape iCal 2.1.0 Patch2
References
- BugTraq: 1768
- URL: http://www.sans.org/rr/paper.php?id=23