Test ID:	10034
Category:	Web application abuses
Title:	RedHat 6.0 cachemgr.cgi
Summary:	RedHat Linux 6.0 installs by default a squid cache manager cgi script with; no restricted access permissions. This script could be used to perform a port scan from the cgi-host machine.
Description:	Summary: RedHat Linux 6.0 installs by default a squid cache manager cgi script with no restricted access permissions. This script could be used to perform a port scan from the cgi-host machine. Solution: If you are not using the box as a Squid www proxy/cache server then uninstall the package by executing: /etc/rc.d/init.d/squid stop, rpm -e squid If you want to continue using the Squid proxy server software, make the following actions to tighten security access to the manager interface: mkdir /home/httpd/protected-cgi-bin mv /home/httpd/cgi-bin/cachemgr.cgi /home/httpd/protected-cgi-bin/ And add the following directives to /etc/httpd/conf/access.conf: # Protected cgi-bin directory for programs that # should not have public access order deny, allow deny from all allow from localhost #allow from .your_domain.com AllowOverride None Options ExecCGI and /etc/httpd/conf/srm.conf: ScriptAlias /protected-cgi-bin/ /home/httpd/protected-cgi-bin/ CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	BugTraq ID: 2059 Common Vulnerability Exposure (CVE) ID: CVE-1999-0710 http://www.securityfocus.com/bid/2059 Bugtraq: 19990725 Redhat 6.0 cachemgr.cgi lameness (Google Search) Debian Security Information: DSA-576 (Google Search) http://www.debian.org/security/2004/dsa-576 http://www.redhat.com/archives/fedora-announce-list/2005-May/msg00025.html http://fedoranews.org/updates/FEDORA--.shtml http://www.redhat.com/support/errata/RHSA-1999-025.html http://www.redhat.com/support/errata/RHSA-2005-489.html XForce ISS Database: http-cgi-cachemgr(2385) https://exchange.xforce.ibmcloud.com/vulnerabilities/2385
Copyright	Copyright (C) 1999 A. de Bernis

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.