Novell HTTP server

• If you are running the Novell HTTP server, please disable the CGI's it comes with it until you understand (fully understand) what the security risks are.

• The CGI in question is convert.bas (yes, cgi's in basic, stop laughing).

• A remote user can read any file on the remote file system using this CGI.

• This means that if you are running the Novell HTTP server and have the 'out of box' CGI's, you are breached.

• Exploit code:

• http://victim.com/scripts/convert.bas?../../anything/you/want/to/view

Slide anterior

Slide seguinte

Voltar para o primeiro slide

Exibir versão do elemento gráfico