Test ID:	10015
Category:	CGI abuses
Title:	AltaVista Intranet Search
Summary:	NOSUMMARY
Description:	Description: It is possible to read the content of any files on the remote host (such as your configuration files or other sensitive data) by using the Altavista Intranet Search service, and performing the request: GET /cgi-bin/query?mss=%2e%2e/config Bugtraq ID : 896 Solution : - edit /httpd/config file and change MGMT_IPSPEC from '0.0.0.0/0' to a specific IP such as '127.0.0.1/32' - stop page gathering via the management interface - restart Altavista Search Service (to re-read config file) - restart page gathering if necessary - change the username/password through the management interface to bogus information - exploit server and download ../logs/mgtstate (puts file in cache) http://localhost:9000/cgi-bin/query?mss=../logs/mgtstate - change the username/password through the management interface to something different (but not used anywhere else) - avoid restarting the Altavista service or clearing the cache Risk factor : High
Cross-Ref:	BugTraq ID: 896 Common Vulnerability Exposure (CVE) ID: CVE-2000-0039 http://www.securityfocus.com/bid/896 Bugtraq: 19991229 AltaVista (Google Search) Bugtraq: 19991229 AltaVista followup and monitor script (Google Search) Bugtraq: 19991230 Follow UP AltaVista (Google Search) Bugtraq: 20000103 FW: Patch issued for AltaVista Search Engine Directory TraversalVulnerability (Google Search) Bugtraq: 20000109 Altavista followup (Google Search) http://www.osvdb.org/15
Copyright	This script is Copyright (C) 2000 Renaud Deraison

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.