KW Whois CGI whois Parameter Arbitrary Command Execution

This script is Copyright (C) 2000-2011 Tenable Network Security, Inc.


Synopsis :

The remote web server hosts a CGI script that allows execution of
arbitrary commands.

Description :

The version of the KW whois CGI script installed on the remote web
server fails to filter input to the 'whois' parameter of shell
metacharacters. An unauthenticated, remote attacker can leverage this
issue to execute arbitrary commands with the privileges of the http
daemon.

See also :

http://archives.neohapsis.com/archives/bugtraq/2000-10/0419.html

Solution :

Unknown at this time.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS Temporal Score : 7.1
(CVSS2#E:F/RL:U/RC:ND)
Public Exploit Available : true

Family: CGI abuses

Nessus Plugin ID: 10541 (kw_whois.nasl)

Bugtraq ID: 1883

CVE ID: CVE-2000-0941