Re: [Fwd: Vulnerabilities in Informix Webdriver]

Good point, just emailed the author asking for details on the setup brett Paul Watson wrote: > > Which versions? and what webserver? > > Apache 1.3.12/WebDriver4.00.UC1 under Solaris 2.7 is OK, or appears to > be. > > Brett Geer wrote: > > > > Anyone know anything about this? from the BUGTRAQ list > > > > brett > > > > isno wrote: > > > > > > Webdriver is the web interface of Informix database,I found it is > > > vulnerable.In the common condition,webdriver is submitted with a > > > parameter,but if you type http://victim/cgi-bin/webdriver directly, It > > > will return a webpage which you can modify or delete database on it. > > > > > > Otherwise, webdriver will make a /tmp/.log file,its attribute is > > > -rw-rw-rw,we can make a symlink and get the nobody privilege,although > > > without root privilege,we can deface the website as nobody. > > > > > > > > > > > > isno(isno@etang.com) > > > > > > > -- > > > > ----------------------------------------------------------------- > > Brett's 10th law of UNIX administration... > > rm is forever > > ----------------------------------------------------------------- > > Brett Geer - UNIX Admin/Analyst/Programmer - Intratex Holdings. > > Tel. +27 31 717 4000 Direct. +27 31 717 4146 > > Fax. +27 31 717 4001 > > ----------------------------------------------------------------- > > The little voices are talking to me again, telling me to reach > > for a keyboard and type rm -rf /* > > last week they had me rm -rf `echo $MANPATH | sed 's/:/ /g'` > > now I fear I have no answers > > ----------------------------------------------------------------- > > -- > Paul Watson # > Oninit Ltd # You are only young once > Tel: +44 1436 672201 # but you can be immature > Fax: +44 1436 678693 # for ever > www.oninit.com # -- ----------------------------------------------------------------- Brett's 11th law of UNIX administration... Users think that Y2K was a non-event... well... They havn't got our overtime bills yet :) ----------------------------------------------------------------- Brett Geer - UNIX Admin/Analyst/Programmer - Intratex Holdings. Tel. +27 31 717 4000 Direct. +27 31 717 4146 Fax. +27 31 717 4001 ----------------------------------------------------------------- The little voices are talking to me again, telling me to reach for a keyboard and type rm -rf /* last week they had me rm -rf `echo $MANPATH | sed 's/:/ /g'` now I fear I have no answers -----------------------------------------------------------------