Executive brief
A vulnerability in the Count.cgi web tool, which is used to display visitor counters on websites, allows remote attackers to take control of the web server. By sending a specially crafted request, an attacker can execute unauthorized commands on the system. This could lead to the theft of sensitive data, website defacement, or a complete shutdown of the web service.
Technical details
A classic buffer overflow vulnerability exists in the Count.cgi (also known as wwwcount) CGI program. The flaw is triggered when the application fails to properly validate the length of input data passed to it via the network, allowing an attacker to overwrite memory and redirect execution flow. A remote, unauthenticated attacker can exploit this by sending a malicious HTTP request to the cgi-bin directory where Count.cgi is hosted. Successful exploitation results in arbitrary command execution with the privileges of the web server user. This vulnerability was widely discussed in the late 1990s as a common entry point for compromising web servers.
Affected products
- Muhammad A. Muquit wwwcount (Count.cgi) 2.3 and earlier
Timeline
- 1997-11-05: disclosed: Initial public disclosure and NVD publication