REDHAT-BUG-437301: Command Injection

Published Mar 13, 2008

Updated

Richard Megginson discovered a shell command injection flaw in the Admin Server's replication monitor CGI perl script repl-monitor-cgi.pl. Script parameters were not properly sanitized prior to being passed to system() function. An attacker able to access replication monitor CGI script could execute arbitrary shell command with privileges of Admin Server.

Affected versions: - Red Hat Directory Server 7.1 - Admin Server runs with root privileges - Red Hat Directory Server 8 - Admin Server runs under an unprivileged user, following users by default: - nobody on Red Hat Enterprise Linux and Solaris - daemon on HP-UX - Fedora Directory Server - Admin Server runs under an unprivileged user, nobody by default

Affected Software

2 affected components

Red Hat Directory Server

Fedora Directory Server

Event History

Mar 13, 2008

Data Sourced

via Red Hat·02:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-437301?

The vulnerability REDHAT-BUG-437301 is classified as a critical shell command injection flaw affecting the Admin Server's replication monitor CGI script.

How do I fix REDHAT-BUG-437301?

To fix REDHAT-BUG-437301, ensure that the parameters passed to the system() function in the perl script repl-monitor-cgi.pl are properly sanitized.

Who discovered REDHAT-BUG-437301?

REDHAT-BUG-437301 was discovered by Richard Megginson.

Which software is affected by REDHAT-BUG-437301?

The affected software for REDHAT-BUG-437301 includes Red Hat Directory Server and Fedora Directory Server.

What are the potential risks of REDHAT-BUG-437301?

Exploiting REDHAT-BUG-437301 could allow an attacker to execute arbitrary shell commands on the server, leading to unauthorized access and data breaches.