SCAN: Verity Search97 Access
This signatures detects access to search97.vts, a CGI script that contains several vulnerabilities. Attackers can read any file on the Web server or shutdown the script.
Extended Description
A pair of vulnerabilities exist in Verity's Search`97 web interface to the Verity search engine. The first vulnerability is due to cgi-bin scripts, s97_cgi and s97r_cgi failing to check for the existence of certain shell meta characters. This allows an attacker to access any file on the file system. The second vulnerability is due to a lack of authentication being used to access the Verity administrative program. Any user can telnet to the appropriate port, and issue a command to shut the Verity software down.
Affected Products
Verity_inc. search97
Short Name
SCAN:MISC:HTTP:SEARCH97-VTS
Severity
Info
Recommended
False
Recommended Action
None
Category
SCAN
Keywords
Access Search97 Verity bid:162
Release Date
02/23/2005
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3375
False Positive
Rarely
Vendors
Verity_inc.