Detections
Analytics

WebSite Pro webfind.exe keywords Parameter Remote Overflow

critical Nessus Plugin ID 10475

Synopsis

The remote web server contains a CGI script that is affected by a buffer overflow flaw.

Description

The 'webfind.exe' CGI script on the remote host is vulnerable to a buffer overflow when given a too long 'keywords' argument. This problem allows an attacker to execute arbitrary code as root on this host.

Solution

Upgrade to WebSite Professional 2.5 or delete this CGI.

See Also

https://seclists.org/bugtraq/2000/Jul/268

Plugin Details

Severity: Critical

ID: 10475

File Name: webfind.nasl

Version: 1.34

Type: remote

Family: CGI abuses

Published: 7/22/2000

Updated: 1/19/2021

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

Required KB Items: Settings/ParanoidReport, www/websitepro

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No exploit is required

Vulnerability Publication Date: 7/19/2000

Reference Information

CVE: CVE-2000-0622

BID: 1487