Signature Detail
Short Name |
SCAN:MISC:HTTP:UPLOADER-EXE |
|---|---|
Severity |
Info |
Recommended |
No |
Category |
SCAN |
Keywords |
Uploader.exe Access |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
SCAN: Uploader.exe Access
This signature detects access to the uploader.exe CGI program. Attackers can exploit this program to remotely execute arbitrary commands on the Web server.
Extended Description
By default, O'Reilly WebSite Pro installs the following directories on the web root as read accessible by any user: cgi-win cgi-shl cgi-src cgi-temp The program uploader.exe exists in the /cgi-win directory. Any remote user can execute this program by performing a GET request for http://target/cgi-win/uploader.exe. This program will allow the user to upload any file to the remote server.
Affected Products
- OReilly Software WebSite Professional 2.3.7
References
- BugTraq: 1611
- CVE: CVE-1999-0177
- URL: http://www.securityfocus.com/archive/1/79791
- URL: http://website.oreilly.com/