Metacharacterbug in the Fastgraf whois.cgi perlscript

-----------------------------------------------------



Author            : Fastgraf (c) All rights reserved.

url                   : http://www.fastgraf.com

realeasedate  : 03/01/99



Problem:

The whois.cgi script of Fastgraf has almost no metacharcterchecking

which enables attackers to execute commands as uid of the webserver.



The metacharcterbug in the script:



   $FORM{'host'} =~ s/(\;)//g;



As you can see only the ";" gets deleted. So attackers are still able

to use pipes, redirectioncharacters and so on.



Solution:



Change the filtering to:



   $FORM{'host'} =~ s/(\W)/\\$1/g;



The author has been notified to correct this problem.



-----------

ping.cgi, traceroute.cgi and finger.cgi  have the same bug ;)

-----------



grtz,

Marco van Berkum

------------------------------------------------------------

Sex is like hacking. You get in, you get out,

and you hope you didn't leave something behind

that can be traced back to you.



Marco van Berkum, System Operator/Security Analyst OBIT b.v.

RIPEHANDLE: MB17300-RIPE