htsearch CGI program in htdig (ht://Dig) 3.1.5 and earlier allows remote attackers to use the -c option to specify an alternate configuration file, which could be used to (1) cause a denial of service (CPU consumption) by specifying a large file such as /dev/zero, or (2) read arbitrary files by uploading an alternate configuration file that specifies the target file.

Nergal reported a vulnerability in the htsearch program which is  distributed as part of the ht://Dig package, an indexing and  searching system for small domains or intranets. Using former  versions it was able to pass the parameter -c to the cgi program in  order to use a different configuration file.

A malicious user could point htsearch to a file like/dev/zero and let the server run in an endless loop, trying to read config parameters.
If the user has write permission on the server they can point the program to it and retrieve any file readable by the webserver user id.

A problem was discovered in the ht://Dig web indexing and searching program. Nergal reported a vulnerability in htsearch that allows a remote user to pass the -c parameter, to use a specific config file, to the htsearch program when running as a CGI. A malicious user could point to a file like /dev/zero and force the CGI to stall until it times out. Repeated attacks could result in a DoS. As well, if the user has write permission on the server and can create a file with certain entries, they can point the server to it and retrieve any file readable by the webserver UID.

The remote CGI htsearch allows the user to supply his own configuration file using the '-c' switch, as in :

	/cgi-bin/htsearch?-c/some/config/file

This file is not displayed by htsearch. However, if an attacker manages to upload a configuration file to the remote server, it may make htsearch read arbitrary files on the remote host.

An attacker may also use this flaw to exhaust the resources on the remote host by specifying /dev/zero as a configuration file.

ID	Name	Product	Family	Severity
14917	Debian DSA-080-1 : htdig - unauthorized gathering of data	Nessus	Debian Local Security Checks	medium
13896	Mandrake Linux Security Advisory : htdig (MDKSA-2001:083)	Nessus	Mandriva Local Security Checks	medium
10784	ht://Dig htsearch Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2001-0834

high

Tenable Plugins

medium

medium

medium