HTTP: Hylafax Faxsurvey Remote Command Execution
This signature detects attempts to exploit a known vulnerability against faxsurvey CGI script in the HylaFAX package. Attackers can remotely execute arbitrary commands on the Web server.
Extended Description
Hylafax is a popular fax server software package designed to run on multiple UNIX operating systems. Unpatched version of Hylafax ship with an insecure script, faxsurvey, which allows remote command execution with the privileges of the web server process. This can be exploited simply by passing the command as a parameter to the script - see exploit. Consequences could include web site defacements, exploiting locally accessible vulnerabilities to gain further privileges, etc.
Affected Products
Hylafax hylafax
Short Name
HTTP:CGI:FAXSURVEY-REMOTE-EXEC
Severity
Major
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
CVE-1999-0262 CVE-2006-3126 Command Execution Faxsurvey Hylafax Remote bid:2056
Release Date
04/22/2003
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3336
False Positive
Unknown
Vendors
Hylafax
CVSS Score
7.5