A collection of CGI vulnerability attacks in the network security series (I)

The following are some famous CGI vulnerabilities collected and sorted out, and some security suggestions and solutions are provided. If these vulnerabilities are not fixed in time on the server, each vulnerability may be exploited by intruders, increase the server attack index.

1. phf

● Type: attack type

● Risk level: Medium

● Description: there is a program util. c In NCSA or Apache (version 1.1.1 or earlier) Non-commercial Web Server that allows intruders to execute any command as root:

http://www.xxx.com/cgi-bin/phf?Qname=root%0Asome%20command%20here

● Solution: Upgrade Apache web server to 1.1.1 or above, or upgrade NCSA web server to the latest version.

2. wguset.exe

● Type: attack type

● Risk level: Medium

● Description: If Windows NTIS used as the webserveroperating system and wguest.exe exists in the Web Executable Directory, intruders can use it to read all usr _ Files that users can read.

● Solution: Remove or delete wguset.exe from the Web directory.

3. rguset.exe

● Type: attack type

● Risk level: Medium

● Description: If Windows NTIS used as the webserveroperating system and rguest.exe is stored in the Web Executable Directory, intruders can use it to read all usr _ Files that users can read.

● Solution: Remove or delete rguset.exe from the Web directory.

4. perl.exe

● Type: attack type

● Risk level: low

● Description: perl.exe exists in the cgi-binexecution Directory, which is a serious configuration error. The attacker can add a command after perl.exe to execute any script program on the server using a browser.

● Solution: Remove perl.exe from the webdirectory.

5. shtml.exe

● Type: attack type

● Risk level: low

● Description: If Front Page is used as WebServer, intruders can use IUSR _ The user and shtml.exe intrude into the user's machine.

● Solution: Remove or delete shtml.exe from the Web directory.

6. wwwboard. pl

● Type: attack type

● Risk level: low

● Description: The wwwboard. pl program may cause attackers to launch D. O.S attacks on the server.

● Suggestion: delete the file unless necessary.

● Solution: Use the following section in the get_variables Subroutine:

if ($FORM{"followup"}) { $followup = "1"@followup_num = split(/,/,$FORM{"followup"});$num_followups = @followups = @followup_num;$last_message = pop(@followups);$origdate = "$FORM{"origdate"}"$origname = "$FORM{"origname"}"$origsubject = "$FORM{"origsubject"}" }

Replace:

if ($FORM{"followup"}) {$followup = "1"@followup_num = split(/,/,$FORM{"followup"});$num_followups = @followups = @followup_num;$last_message = pop(@followups);$origdate = "$FORM{"origdate"}"$origname = "$FORM{"origname"}"$origsubject = "$FORM{"origsubject"}"# WWWBoard Bomb Patch# Written By: Samuel Sparling sparling@slip.net) $fn=0;while($fn < $num_followups){$cur_fup = @followups $fn]; $dfn=0;foreach $fm(@followups){if(@followups[$dfn] == @followups[$fn] && $dfn != $fn){&error(board_bomb);} $dfn++;} $fn++; }# End WWWBoard Bomb Patch }

7. uploader.exe

● Type: attack type

● Risk level: Medium

● Description: If you use Windows NTAS the webserveroperating system, the attacker can use uploader.exe to upload any files.

● Solution: Remove or delete uploader.exe from the Web directory.

8. bdir. htr

● Type: attack type

● Risk level: high

● Description: If Windows NT is used as the WebServer operating system and bdir. if htr exists in the Web Executable Directory, intruders can use it to create ODBC databases and generate executable files on the server.

● Solution: Remove or delete bdir. htr from the Web directory.

9. Count. cgi

● Type: attack type

● Risk level: high

● Description: The Count. cgi program (Wwwcount2.3) in the/cgi-bin directory has an overflow error that allows intruders to remotely execute any commands without logging on.

● Suggestion: delete the file unless necessary.

● Solution: Upgrade Wwwcount to 2.4 or above.