PROPOSAL: Cluster 10 - CGI (31 candidates)

["Steven M. Christey" <coley@linus.mitre.org>]

This Low controversy cluster contains 31 candidates, all having to do
with vulnerabilities in CGI programs.

- Steve



Summary of votes to use (in ascending order of "severity"):

ACCEPT - member accepts the candidate as proposed
NOOP - member has no opinion on the candidate
MODIFY - member wants to change some minor detail (e.g. reference/description)
REVIEWING - member is reviewing/researching the candidate
RECAST - candidate must be significantly modified, e.g. split or merged
REJECT - candidate is "not a vulnerability", or a duplicate, etc.

Please write your vote on the line that starts with "VOTE: ".  If you
want to add comments or details, add them to lines after the VOTE: line.


=================================
Candidate: CAN-1999-0066
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: XF:http-cgi-anyform

AnyForm CGI remote execution

VOTE: 

=================================
Candidate: CAN-1999-0070
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: XF:http-cgi-test

test-cgi program allows an attacker to list files on the server

VOTE: 

=================================
Candidate: CAN-1999-0146
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: XF:http-cgi-campas

The campas CGI program provided with some NCSA web servers allows an
attacker to read arbitrary files.

VOTE: 

=================================
Candidate: CAN-1999-0147
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: XF:http-cgi-glimpse

The aglimpse CGI program of the Glimpse package allows remote
execution of arbitrary commands

VOTE: 

=================================
Candidate: CAN-1999-0148
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: XF:http-sgi-handler

The handler CGI program in IRIX allows arbitrary command execution.

VOTE: 

=================================
Candidate: CAN-1999-0149
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: XF:http-sgi-wrap

The wrap CGI program in IRIX allows arbitrary command execution from
remote users.

VOTE: 

=================================
Candidate: CAN-1999-0172
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: XF:http-cgi-formmail-exe

FormMail CGI program allows remote execution of commands.

VOTE: 

=================================
Candidate: CAN-1999-0173
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: XF:http-cgi-formmail-use

FormMail CGI program can be used by web servers other than the
host server that the program resides on.

VOTE: 

=================================
Candidate: CAN-1999-0174
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF

The view-source CGI program allows remote attackers to read any file on
the system that is internally accessible by the web server.

VOTE: 

=================================
Candidate: CAN-1999-0176
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: XF:http-webgais-query

The Webgais program allows a remote user to execute arbitrary
commands.

VOTE: 

=================================
Candidate: CAN-1999-0177
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: XF:http-website-uploader

The uploader program in the WebSite web server allows a remote
attacker to execute arbitrary programs.

VOTE: 

=================================
Candidate: CAN-1999-0178
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: XF:http-website-winsample

The win-c-sample program in the WebSite web server has a buffer
overflow that allows remote execution of commands.

VOTE: 

=================================
Candidate: CAN-1999-0191
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF

IIS newdsn.exe CGI script allows remote users to overwrite files.

VOTE: 

=================================
Candidate: CAN-1999-0196
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: XF:http-webgais-smail

The websendmail program in the Webgais program allows a remote user to
access arbitrary files.

VOTE: 

=================================
Candidate: CAN-1999-0233
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: XF:http-iis-cmd

IIS and WebSite allow users to execute arbitrary commands using
.bat or .cmd files.

VOTE: 

=================================
Candidate: CAN-1999-0236
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: XF:http-scriptalias

ScriptAlias directory in NCSA and Apache httpd allowed attackers to
read CGI programs.

VOTE: 

=================================
Candidate: CAN-1999-0237
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: XF:http-cgi-guestbook

Remote execution of arbitrary commands through Guestbook CGI program.

VOTE: 

=================================
Candidate: CAN-1999-0238
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: XF:http-cgi-phpfileread

php.cgi allows attackers to read any file on the system.

VOTE: 

=================================
Candidate: CAN-1999-0253
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: XF:http-iis-2e

IIS 3.0 allows remote intruders to read source code for ASP programs
by using a "2e" instead of a "." in the URL.

VOTE: 

=================================
Candidate: CAN-1999-0262
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF

faxsurvey CGI script on Linux allows remote command execution via
shell metacharacters.

VOTE: 

=================================
Candidate: CAN-1999-0264
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF

htmlscript CGI program allows remote read access to files.

VOTE: 

=================================
Candidate: CAN-1999-0268
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF

MetaInfo MetaWeb web server allows users to upload and execute scripts.

VOTE: 

=================================
Candidate: CAN-1999-0269
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF

Netscape Enterprise servers may list files through the PageServices query.

VOTE: 

=================================
Candidate: CAN-1999-0270
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF

pfdispaly CGI program for SGI's Performer API Search Tool allows read
access to files.

VOTE: 

=================================
Candidate: CAN-1999-0271
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF

Progressive Networks Real Video server (pnserver) can be crashed remotely.

VOTE: 

=================================
Candidate: CAN-1999-0278
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF

In IIS, remote attackers can obtain source code for ASP files by appending
"::$DATA" to the URL.

VOTE: 

=================================
Candidate: CAN-1999-0279
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: CERT:VB-98.01.excite

Excite for Web Servers (EWS) allows remote command execution via
shell metacharacters.

VOTE: 

=================================
Candidate: CAN-1999-0283
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF

The Java Web Server would allow remote users to obtain the source
code for CGI programs.

VOTE: 

=================================
Candidate: CAN-1999-0347
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: BUGTRAQ:Jan26,1999
Reference: NTBUGTRAQ:Jan28,1999

Javascript bug in Internet Explorer 4.01 by adding %01URL allows
reading local files and spoofing of web pages from other sites.

VOTE: 

=================================
Candidate: CAN-1999-0348
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: NTBUGTRAQ:Jan27,1999

IIS ASP caching problem releases sensitive information when two
virtual servers share the same physical directory.

VOTE: 

=================================
Candidate: CAN-1999-0360
Published: 
Final-Decision: 
Interim-Decision: 
Modified: 
Announced: 19990623
Assigned: 19990607
Category: SF
Reference: BUGTRAQ:Jan29,1999
Reference: NTBUGTRAQ:Jan29,1999

MS Site Server 2.0 with IIS 4 can allow users to upload content,
including ASP, to the target web site, thus allowing them to
execute commands remotely.

VOTE: