mnoGoSearch search.cgi Multiple Parameter Remote Overflows

high Nessus Plugin ID 11735

Language:

Synopsis

A CGI script hosted on the remote web server is affected by multiple buffer overflow vulnerabilities.

Description

The mnoGoSearch search.cgi CGI is installed on the remote web server. Older versions of this software have multiple buffer overflow vulnerabilities. A remote attacker could exploit these issues to execute arbitrary code.

Note that Nessus only detected the presence of this CGI, and did not attempt to determine whether or not it is vulnerable.

Solution

Disable this CGI if it is not being used, or upgrade to version 3.1.21 / 3.2.11 or later.

Plugin Details

Severity: High

ID: 11735

File Name: mnogosearch_overflows.nasl

Version: 1.25

Type: remote

Family: CGI abuses

Published: 6/12/2003

Updated: 6/4/2024

Configuration: Enable paranoid mode, Enable thorough checks

Supported Sensors: Nessus

Enable CGI Scanning: true

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:mnogosearch:mnogosearch

Required KB Items: www/mnogosearch, Settings/ParanoidReport

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/17/2003

Vulnerability Publication Date: 6/11/2003

Reference Information

CVE: CVE-2003-0436, CVE-2003-0437

BID: 7865, 7866

Detections

Analytics