ID de Prueba:	1.3.6.1.4.1.25623.1.0.10034
Categoría:	Web application abuses
Título:	RedHat 6.0 cachemgr.cgi
Resumen:	RedHat Linux 6.0 installs by default a squid cache manager cgi script with; no restricted access permissions. This script could be used to perform a port scan from the cgi-host machine.
Descripción:	Summary: RedHat Linux 6.0 installs by default a squid cache manager cgi script with no restricted access permissions. This script could be used to perform a port scan from the cgi-host machine. Solution: If you are not using the box as a Squid www proxy/cache server then uninstall the package by executing: /etc/rc.d/init.d/squid stop, rpm -e squid If you want to continue using the Squid proxy server software, make the following actions to tighten security access to the manager interface: mkdir /home/httpd/protected-cgi-bin mv /home/httpd/cgi-bin/cachemgr.cgi /home/httpd/protected-cgi-bin/ And add the following directives to /etc/httpd/conf/access.conf: # Protected cgi-bin directory for programs that # should not have public access order deny, allow deny from all allow from localhost #allow from .your_domain.com AllowOverride None Options ExecCGI and /etc/httpd/conf/srm.conf: ScriptAlias /protected-cgi-bin/ /home/httpd/protected-cgi-bin/ CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-1999-0710 BugTraq ID: 2059 http://www.securityfocus.com/bid/2059 Bugtraq: 19990725 Redhat 6.0 cachemgr.cgi lameness (Google Search) Debian Security Information: DSA-576 (Google Search) http://www.debian.org/security/2004/dsa-576 http://www.redhat.com/archives/fedora-announce-list/2005-May/msg00025.html http://fedoranews.org/updates/FEDORA--.shtml http://www.redhat.com/support/errata/RHSA-1999-025.html http://www.redhat.com/support/errata/RHSA-2005-489.html XForce ISS Database: http-cgi-cachemgr(2385) https://exchange.xforce.ibmcloud.com/vulnerabilities/2385
Copyright	Copyright (C) 1999 A. de Bernis

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.