|
|
JJ sample CGI program Escape Character Vulnerability
JJ is a sample CGI program distributed with NCSA HTTPd servers. It passes unfiltered user data directly to the /bin/mail program, and as such can be used to escape to a shell using the ~ character on systems with a /bin/mail which allows this. The attacker must know the password the program requests, but by default the program uses HTTPdRocKs or SDGROCKS. These default passwords must be changed in the program's source code. The consequence of a successful exploit is a shell with the UID of the server. |
|
Privacy Statement |