REDHAT-BUG-437301: Command Injection
First published: Thu Mar 13 2008(Updated: )
Richard Megginson discovered a shell command injection flaw in the Admin Server's replication monitor CGI perl script repl-monitor-cgi.pl. Script parameters were not properly sanitized prior to being passed to system() function. An attacker able to access replication monitor CGI script could execute arbitrary shell command with privileges of Admin Server. Affected versions: - Red Hat Directory Server 7.1 - Admin Server runs with root privileges - Red Hat Directory Server 8 - Admin Server runs under an unprivileged user, following users by default: - nobody on Red Hat Enterprise Linux and Solaris - daemon on HP-UX - Fedora Directory Server - Admin Server runs under an unprivileged user, nobody by default
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Directory Server | ||
| Red Hat 389 Directory Server |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-437301?
The vulnerability REDHAT-BUG-437301 is classified as a critical shell command injection flaw affecting the Admin Server's replication monitor CGI script.
How do I fix REDHAT-BUG-437301?
To fix REDHAT-BUG-437301, ensure that the parameters passed to the system() function in the perl script repl-monitor-cgi.pl are properly sanitized.
Who discovered REDHAT-BUG-437301?
REDHAT-BUG-437301 was discovered by Richard Megginson.
Which software is affected by REDHAT-BUG-437301?
The affected software for REDHAT-BUG-437301 includes Red Hat Directory Server and Fedora Directory Server.
What are the potential risks of REDHAT-BUG-437301?
Exploiting REDHAT-BUG-437301 could allow an attacker to execute arbitrary shell commands on the server, leading to unauthorized access and data breaches.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2008-0892
- agent/severity
- agent/references
- agent/weakness
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat directory server
- vendor/fedora
- canonical/red hat 389 directory server