Signature Detail

SCAN: Nessus Count.cgi Access

This signature detects access to the count.cgi CGI script. This script contains multiple well-known security vulnerabilities, including one that lets attackers send over-long queries to the program that can cause a buffer overflow and allow arbitrary code execution. This attack is included in the Nessus penetration testing program.

Extended Description

Wwwcount (count.cgi) is a very popular CGI program used to track website usage. In particular, it enumerates the number of hits on given webpages and increments them on a 'counter'. In October of 1997 two remotely exploitable problems were discovered with this program. The first problem was somewhat innocuous in that it only allowed remote users to view .GIF files they were not supposed to have access to. This may be dangerous if the site contains sensitive data in .GIF files such as demographic/financial data in charts etc. The second and most serious problem is a buffer overflow in QUERY_STRING enviroment variable handled by the program. In essence a remote user can send an overloy long query to the program and overflow a buffer in order to execute their own commands as whatever privelage level the program is running as.

Affected Products

• Muhammad A. Muquit wwwcount 2.3.0

References

• BugTraq: 128
• CVE: CVE-1999-0021