MetaInfo Web Server Traversal Arbitrary Command Execution

critical Nessus Plugin ID 10141

Synopsis

The remote host has a command execution vulnerability.

Description

The remote MetaInfo web server (installed with MetaInfo's Sendmail or MetaIP servers) has an arbitrary command execution vulnerability. It is possible to read files or execute arbitrary commands by prepending the appropriate number of '../' to the desired filename. A remote attacker could exploit this to execute arbitrary commands on the system.

Solution

Upgrade to the latest version of this software.

Plugin Details

Severity: Critical

ID: 10141

File Name: metainfo_mail.nasl

Version: 1.34

Type: remote

Family: Web Servers

Published: 6/22/1999

Updated: 11/15/2018

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

Required KB Items: Settings/ParanoidReport

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 6/30/1998

Reference Information

CVE: CVE-1999-0268

BID: 110

Detections

Analytics