Bugtraq: RE: new advisory

[sj () datanet hu]

I think some filtering after the line '$q = new CGI;' would help a little

Eg.

my $SECMSG = 'Pliz dont hekk us\n";

if(!defined $q->param('cfg')){ die "missing cfg file\n"; }
my $xx = $q->param('cfg');

if($xx =~ /\.\.|\/\/|\.\//){ die $SECMSG; }
if($xx =~ tr/a-zA-Z0-9_\-//dc){ die $SECMSG; }

you could also check the ownership of $cfgfile and deny opening
root (and maybe other) owned files.

> > Exploit :
> >
> > http://www.target.com/cgi-bin/14all.cgi?cfg=../../../../../../../../etc/passwd
> > http://www.target.com/cgi-bin/14all-1.1.cgi?cfg=../../../../../../../../etc/passwd
> > http://www.target.com/cgi-bin/traffic.cgi?cfg=../../../../../../../../etc/passwd
> > http://www.target.com/cgi-bin/mrtg.cgi?cfg=../../../../../../../../etc/passwd

SJ.