HTTP: ht://dig Arbitrary File Inclusion
This signature detects attempts to exploit a vulnerability in ht://dig, a Web content search engine for UNIX. Because ht://dig improperly validates form input, attackers can pass a maliciously crafted variable to the htsearch CGI script to read files accessible to the program user.
Extended Description
ht://dig is a web content search engine for Unix platforms. The software is set up to allow for file inclusion from configuration files. Any string surrounded by the opening singlw quote character ( ` ) is taken as a path to a file for inclusion, for example: some_parameter: `var/htdig/some_file` htdig will also allow included files to be specified via form input. Therefore, any file can be specified for inclusion into a variable by any web user.
Affected Products
The_ht://dig_group ht://dig
Short Name
HTTP:CGI:HTDIG-INCLUSION
Severity
Minor
Recommended
False
Recommended Action
None
Category
HTTP
Keywords
Arbitrary CVE-2000-0208 File Inclusion bid:1026 ht://dig
Release Date
04/22/2003
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3375
False Positive
Unknown
Vendors
The_ht://dig_group
CVSS Score
5.0