|
|
Family: Mandrake Local Security Checks --> Category: infos
MDKSA-2001:083: htdig Vulnerability Scan
Vulnerability Scan Summary
Check for the version of the htdig package
Detailed Explanation for this Vulnerability Test
The remote host is missing the patch for the advisory MDKSA-2001:083 (htdig).
A problem was discovered in the ht://Dig web indexing and searching program.
Nergal reported a vulnerability in htsearch that allows a remote user to pass
the -c parameter, to use a specific config file, to the htsearch program when
running as a CGI. A malicious user could point to a file like /dev/zero and
force the CGI to stall until it times out. Repeated attacks could result in a
DoS. As well, if the user has write permission on the server and can create a
file with certain entries, they can point the server to it and retrieve any file
readable by the webserver UID.
Solution : http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2001:083
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|
