Home ▼ Bookkeeping
Online ▼ Security
Audits ▼
Managed
DNS ▼
About
Order
FAQ
Acceptable Use Policy
Dynamic DNS Clients
Configure Domains Dyanmic DNS Update Password Network
Monitor ▼
Enterprise Package
Advanced Package
Standard Package
Free Trial
FAQ
Price/Feature Summary
Order/Renew
Examples
Configure/Status Alert Profiles | |||
Test ID: | 10365 |
Category: | CGI abuses |
Title: | Windmail.exe allows any user to execute arbitrary commands |
Summary: | NOSUMMARY |
Description: | Description: The 'windmail.exe' CGI is installed. Some versions of this CGI script have a security flaw that lets an attacker execute arbitrary commands on the remote server. To test this, make the following request : GET /cgi-bin/windmail.exe?-n%20c:\boot.ini%20you@youraddress.com (replace you@youraddress.com by your real email address). If you receive the content of the file boot.ini, then your server is vulnerable. Solution : remove it from /cgi-bin. See www.geocel.com for a new version. Risk factor : High |
Cross-Ref: |
BugTraq ID: 1073 Common Vulnerability Exposure (CVE) ID: CVE-2000-0242 http://www.securityfocus.com/bid/1073 Bugtraq: 20000325 Windmail allow web user get any file (Google Search) http://www.securityfocus.com/templates/archive.pike?list=1&date=2000-03-22&msg=20000325224146.6839.qmail@securityfocus.com XForce ISS Database: windmail-fileread XForce ISS Database: windmail-pipe-command |
Copyright | This script is Copyright (C) 2000 Renaud Deraison |
This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below. |