Test ID:	1.3.6.1.4.1.25623.1.0.10034
Category:	Web application abuses
Title:	RedHat 6.0 cachemgr.cgi
Summary:	Checks whether the cachemgr.cgi is installed and accessible.
Description:	RedHat Linux 6.0 installs by default a squid cache manager cgi script with no restricted access permissions. This script could be used to perform a port scan from the cgi-host machine. Solution : If you are not using the box as a Squid www proxy/cache server then uninstall the package by executing: /etc/rc.d/init.d/squid stop rpm -e squid If you want to continue using the Squid proxy server software, make the following actions to tighten security access to the manager interface: mkdir /home/httpd/protected-cgi-bin mv /home/httpd/cgi-bin/cachemgr.cgi /home/httpd/protected-cgi-bin/ And add the following directives to /etc/httpd/conf/access.conf and srm.conf: --- start access.conf segment --- # Protected cgi-bin directory for programs that # should not have public access order deny,allow deny from all allow from localhost #allow from .your_domain.com AllowOverride None Options ExecCGI --- end access.conf segment --- --- start srm.conf segment --- ScriptAlias /protected-cgi-bin/ /home/httpd/protected-cgi-bin/ --- end srm.conf segment ---
Cross-Ref:	BugTraq ID: 2059 Common Vulnerability Exposure (CVE) ID: CVE-1999-0710 Bugtraq: 19990725 Redhat 6.0 cachemgr.cgi lameness (Google Search) Debian Security Information: DSA-576 (Google Search) http://www.debian.org/security/2004/dsa-576 http://www.redhat.com/archives/fedora-announce-list/2005-May/msg00025.html http://fedoranews.org/updates/FEDORA--.shtml http://www.redhat.com/support/errata/RHSA-1999-025.html http://www.redhat.com/support/errata/RHSA-2005-489.html http://www.securityfocus.com/bid/2059 XForce ISS Database: http-cgi-cachemgr(2385) http://xforce.iss.net/xforce/xfdb/2385
Copyright	This script is Copyright (C) 1999 A. de Bernis

This is only one of 32582 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.

New User Registration Email: UserID: Passwd: Please email me your monthly newsletters, informing the latest services, improvements & surveys. Please email me a vulnerability test announcement whenever a new test is added.     Privacy

Registered User Login   UserID:     Passwd:     Forgot userid or passwd? Email/Userid: