Executive brief
The info2www CGI script, which is used to convert GNU info files into HTML for web viewing, contains a vulnerability that allows remote attackers to access files or execute commands on the server. This could lead to the exposure of sensitive system files or a complete takeover of the web server by an unauthorized user. The flaw is particularly dangerous because it can be exploited over the network without any prior authentication.
Technical details
The info2www CGI script is vulnerable to an input validation flaw that allows for remote file disclosure and arbitrary command execution. By sending specially crafted requests to the script, a remote, unauthenticated attacker can bypass intended restrictions to read arbitrary files on the filesystem or execute system-level commands with the privileges of the web server process. This is likely due to insufficient sanitization of user-supplied parameters passed to shell commands or file-opening functions. The vulnerability is exploitable over the network (HTTP) and requires no user interaction.
Affected products
- info2www info2www
Timeline
- 1998-03-01: disclosed