Symantec™ Security Gateways Reference Guide - Sawmill

IDS eventsSignatures359HTTP CGI Count RequestBase Event:Details:Response:Wwwcount (count.cgi) is a very popular CGI program used to track Web site usage that enumeratesthe number of hits on given Web pages and increments them on a ‘counter’. In October of 1997 tworemotely exploitable problems were discovered with this program. The first problem, thoughsomewhat innocuous in that it only allowed remote users to view .gif files to which they were notsupposed to have access. The danger is these .gif files contain sensitive data relating todemographics and finances.The second and more serious problem is a buffer overflow in QUERY_STRING environmentvariable handled by the program. In essence, a remote user can send an overly long query to theprogram, overflow a buffer and execute their own commands at whatever privilege level theprogram is running as.If you are running version 2.3 of Wwwcount it is suggested you upgrade immediately. In themeantime you may wish to consider removing the execution bit on this program.Affected: Muhammad A. Muquit wwwcount 2.3False Positives: None known.ReferencesCVE-1999-0021Security Focus BID: 128Security Focus Advisory: 171HTTP FormMail Command ExecBase Event:Details:Response:Affected:FORMMAIL_COMMAND_EXECMatt Wright’s FormMail is a Web-based email gateway. In versions 1.9 and earlier, the “recipient”hidden field is not checked for the semi-colon(;), the shell command separation character. Thisenables remote arbitrary command execution.Upgrade to a newer version.Matt Wright FormMail 1.9 and earlier.False Positives: None known.ReferencesCVE-1999-0172Security Focus BID: 2079HTTP Htgrep CGI File AccessBase Event:Details:Response:Affected:HTGREP_CGI_FILE_ACCESSHtgrep CGI program lets remote attackers read arbitrary files by specifying the full pathname inthe hdr parameter.Make sure that you are using the latest set of definitions to prevent such attacks.Microsoft Windows NT, UNIX and Linux. (all versions).False Positives: This signature may produce false positives when any legitimate traffic that attempts to use htgrepin a similar manner as the vulnerability.ReferencesCAN-2000-0832