发布时间 :2001-08-02 00:00:00
修订时间 :2008-09-05 16:25:45

[原文]Sdbsearch.cgi in SuSE Linux 6.0-7.2 could allow remote attackers to execute arbitrary commands by uploading a keylist.txt file that contains filenames with shell metacharacters, then causing the file to be searched using a .. in the HTTP referer (from the HTTP_REFERER variable) to point to the directory that contains the keylist.txt file.

[CNNVD]SuSE Linux Sdbsearch.cgi执行任意命令漏洞(CNNVD-200108-017)

        SuSE Linux 6.0-7.2版本中的Sdbsearch.cgi存在漏洞,远程攻击者通过上传包含带有shell元字符文件名的keylist.txt文件执行任意命令,然后使用HTTP提交者(来自HTTP_REFERER变量)中的..搜索该文件从而指向包含keylist.txt文件的目录。

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/o:suse:suse_linux:7.2SuSE SuSE Linux 7.2
cpe:/o:suse:suse_linux:7.0SuSE SuSE Linux 7.0
cpe:/o:suse:suse_linux:6.3SuSE SuSE Linux 6.3
cpe:/o:suse:suse_linux:7.1SuSE SuSE Linux 7.1
cpe:/o:suse:suse_linux:6.0SuSE SuSE Linux 6.0
cpe:/o:suse:suse_linux:6.4SuSE SuSE Linux 6.4

- OVAL (用于检测的技术细节)


- 官方数据库链接
(官方数据源) MITRE
(官方数据源) NVD
(官方数据源) CNNVD

- 其它链接及资源
(VENDOR_ADVISORY)  XF  sdbsearch-cgi-command-execution(7003)
(VENDOR_ADVISORY)  BUGTRAQ  20010802 suse: sdbsearch.cgi vulnerability
(UNKNOWN)  SUSE  SuSE-SA:2001:027

- 漏洞信息

SuSE Linux Sdbsearch.cgi执行任意命令漏洞
高危 未知
2001-08-02 00:00:00 2005-05-02 00:00:00
        SuSE Linux 6.0-7.2版本中的Sdbsearch.cgi存在漏洞,远程攻击者通过上传包含带有shell元字符文件名的keylist.txt文件执行任意命令,然后使用HTTP提交者(来自HTTP_REFERER变量)中的..搜索该文件从而指向包含keylist.txt文件的目录。

- 公告与补丁


- 漏洞信息 (21075)

SuSE 6.3/6.4/7.0 sdb Arbitrary Command Execution Vulnerability (EDBID:21075)
linux remote
2001-08-02 Verified
0 Maurycy Prodeus
N/A [点击下载]

An input validation error exists in sdb, the SuSE Support Data Base.

The problem exists in the sdbsearch.cgi script, which uses data directly from the 'Referer' header field from a HTTP request as a path when opening it's "keylist.txt" file. The keylist file contains a list of keywords and associated files, which are opened using Perl's open() command.

If an attacker is able to create a malicious "keylist.txt" file on a vulnerable host, it may be possible for the attacker to cause arbitrary commands to be executed by the sdbsearch.cgi script. 

Proof of concept is very simple, just create harmful keylist.txt for instance in /tmp directory and send request to http server like this:

GET /cgi-bin/sdbsearch.cgi?stichwort=keyword HTTP/1.0

(very deep traversal because we don't know what is DOCUMENT_ROOT)

and an example content of our /tmp/keylist.txt create like this:
$ echo -e "keyword\0touch exploitable|" > /tmp/keylist.txt

After successful attempt there will be "exploitable" file in /tmp directory. 		

- 漏洞信息

SuSE Support Data Base (sdb) sdbsearch.cgi Arbitrary Command Execution
Remote / Network Access Input Manipulation
Loss of Integrity
Exploit Public

- 漏洞描述

The SuSe Support Data Base search script (sdbsearch.cgi) contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to script trusting the HTTP_REFERER field in a web request as the valid path to 'keyfile.txt'. If a malicious 'keyfile.txt' file is created on the server an attacker can set HTTP_REFERER to the path of the bogus 'keyfile.txt' and sbsearch.cgi will execute the commands in the file.

- 时间线

2001-08-02 Unknow
2001-08-02 Unknow

- 解决方案


Unknown or Incomplete

- 相关参考

- 漏洞作者

Unknown or Incomplete