[Fwd: Vulnerabilities in Informix Webdriver]
Anyone know anything about this? from the BUGTRAQ list brett isno wrote: > > Webdriver is the web interface of Informix database,I found it is > vulnerable.In the common condition,webdriver is submitted with a > parameter,but if you type http://victim/cgi-bin/webdriver directly, It > will return a webpage which you can modify or delete database on it. > > Otherwise, webdriver will make a /tmp/.log file,its attribute is > -rw-rw-rw,we can make a symlink and get the nobody privilege,although > without root privilege,we can deface the website as nobody. > > > > isno(isno@etang.com) > -- ----------------------------------------------------------------- Brett's 10th law of UNIX administration... rm is forever ----------------------------------------------------------------- Brett Geer - UNIX Admin/Analyst/Programmer - Intratex Holdings. Tel. +27 31 717 4000 Direct. +27 31 717 4146 Fax. +27 31 717 4001 ----------------------------------------------------------------- The little voices are talking to me again, telling me to reach for a keyboard and type rm -rf /* last week they had me rm -rf `echo $MANPATH | sed 's/:/ /g'` now I fear I have no answers -----------------------------------------------------------------
Which versions? and what webserver? Apache 1.3.12/WebDriver4.00.UC1 under Solaris 2.7 is OK, or appears to be. Brett Geer wrote: > > Anyone know anything about this? from the BUGTRAQ list > > brett > > isno wrote: > > > > Webdriver is the web interface of Informix database,I found it is > > vulnerable.In the common condition,webdriver is submitted with a > > parameter,but if you type http://victim/cgi-bin/webdriver directly, It > > will return a webpage which you can modify or delete database on it. > > > > Otherwise, webdriver will make a /tmp/.log file,its attribute is > > -rw-rw-rw,we can make a symlink and get the nobody privilege,although > > without root privilege,we can deface the website as nobody. > > > > > > > > isno(isno@etang.com) > > > > -- > > ----------------------------------------------------------------- > Brett's 10th law of UNIX administration... > rm is forever > ----------------------------------------------------------------- > Brett Geer - UNIX Admin/Analyst/Programmer - Intratex Holdings. > Tel. +27 31 717 4000 Direct. +27 31 717 4146 > Fax. +27 31 717 4001 > ----------------------------------------------------------------- > The little voices are talking to me again, telling me to reach > for a keyboard and type rm -rf /* > last week they had me rm -rf `echo $MANPATH | sed 's/:/ /g'` > now I fear I have no answers > ----------------------------------------------------------------- -- Paul Watson # Oninit Ltd # You are only young once Tel: +44 1436 672201 # but you can be immature Fax: +44 1436 678693 # for ever www.oninit.com #