Signature Detail
Short Name |
SCAN:NESSUS:NPH-PUBLISH-CGI |
|---|---|
Severity |
Info |
Recommended |
No |
Category |
SCAN |
Keywords |
Nessus nph-publish.cgi Access |
Release Date |
2006/03/29 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
SCAN: Nessus nph-publish.cgi Access
This signature detects attempts to access the nph-publish.cgi CGI script. This script has well-known security vulnerabilities that allow an unauthenticated remote attacker to run arbitrary code with HTTP daemon privileges. This attack is included in the Nessus penetration testing tool.
Extended Description
nph-maillist is a Perl CGI script that handles mailing lists, typically used to notify interested users of site updates. A hostile user can enter commands embedded in an email address via the subscription form, and then force a mailing which will execute the commands.
Affected Products
- Matt Tourtillott nph-maillist 3.0.0
- Matt Tourtillott nph-maillist 3.5.0
References
- BugTraq: 2563
- CVE: CVE-2001-0400