[mrtg] Re: directory traversal problems with 14all.cgi

[Paul C. Williamson]

After this came out on securityfocus.com, I immediately 
notifed our Information Security group just to let them 
know I was aware of thre problem and was investigating it.  

Turns out that I can't get my 14all.cgi to replicate this issue.
I don't know why, which concerns me.  I'd like to know what 
specific configuration exposes this vulnerability.  If anyone has 
any more info, please post it to the list...

Paul

>>> <Greg.Volk at edwardjones.com> 02/06/02 11:28AM >>>

A coworker of mine recently demonstrated to me that the way I
currently have 14all.cgi configured, it is vulnerable to a 
directory traversal attack. What he couldn't tell me, and I
couldn't figure out on my own, is how to remedy this problem.

The following line currently displays the first line of my
/etc/hosts to anyone who wants to know. Not a big deal, since
this is not a publically accessible server, but something I 
would like to fix nonetheless.

http://mrtgserver/cgi-bin/14all.cgi?cfg=../../../../../../../../etc/hosts 
My question is what can I do to fix this? 
Am I looking at an httpd misconfiguration? 
Incorrect permissions for user "nobody?"
A 14all misconfiguration?

Is anybody else having this problem?

I looked through the archives and ran several queries against
google looking for more info about this but didn't find anything.


--
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe 
Archive     http://www.ee.ethz.ch/~slist/mrtg 
FAQ         http://faq.mrtg.org    Homepage     http://www.mrtg.org 
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi 



--
Unsubscribe mailto:mrtg-request at list.ee.ethz.ch?subject=unsubscribe
Archive     http://www.ee.ethz.ch/~slist/mrtg
FAQ         http://faq.mrtg.org    Homepage     http://www.mrtg.org
WebAdmin    http://www.ee.ethz.ch/~slist/lsg2.cgi