RE: A small quandary

From: Bojan Zdrnja <Bojan.Zdrnja(at)FER.hr>
Date: Mon Dec 09 2002 - 06:02:48 EST

> -----Original Message-----

Exactly my words :)

> > /scripts..%c1%9c../winnt/system32/cmd.exe?/c+dir+c:

Only second scan isn't IIS vulnerability - it's mrtg cgi script vulnerability which allows attacker to display arbitrary files. For more info check: http://online.securityfocus.com/bid/4017/info/. It's typical input validation error.

Best regards,

Bojan Zdrnja

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Tue Dec 10 00:54:34 2002