Signature Detail
Short Name |
SCAN:MISC:HTTP:MMSTDOD-PROBE |
|---|---|
Severity |
Info |
Recommended |
No |
Category |
SCAN |
Keywords |
Mmstdod.cgi Probe |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
SCAN: Mmstdod.cgi Probe
This signature detects access to the mmstdod.cgi script, a common target of vulnerability scans.
Extended Description
A vulnerability exists in 3.x versions of Endymion MailMan Webmail prior to release 3.0.26. The widely-used Perl script provides a web-email interface. Affected versions make insecure use of the perl open() function. Attackers can control the way open() is supposed to work and execute arbitrary commands. These commands will be executed with the privilege level of the CGI script (commonly user 'nobody'). This vulnerability may allow remote attackers to gain interactive 'local' access on the target server.
Affected Products
- Endymion MailMan WebMail 3.0.0
- Endymion MailMan WebMail 3.0.1
- Endymion MailMan WebMail 3.0.10
- Endymion MailMan WebMail 3.0.11
- Endymion MailMan WebMail 3.0.12
- Endymion MailMan WebMail 3.0.13
- Endymion MailMan WebMail 3.0.14
- Endymion MailMan WebMail 3.0.15
- Endymion MailMan WebMail 3.0.16
- Endymion MailMan WebMail 3.0.18
- Endymion MailMan WebMail 3.0.19
- Endymion MailMan WebMail 3.0.20
- Endymion MailMan WebMail 3.0.21
- Endymion MailMan WebMail 3.0.22
- Endymion MailMan WebMail 3.0.23
- Endymion MailMan WebMail 3.0.24
- Endymion MailMan WebMail 3.0.25
References
- BugTraq: 2063
- CVE: CVE-2001-0021