Nessus Plugin #10811

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

ActivePerl perlIS.dll Buffer Overflow

Family:

CGI abuses

Category:

destructive_attack

Copyright:

This script is Copyright (C) 2001 H D Moore & Drew Hintz ( http://guh.nu )

Summary:

Determines if arbitrary commands can be executed thanks to ActivePerl's perlIS.dll

Version:

$Revision: 1.15 $

Cve_id:

CVE-2001-0815

Bugtraq_id:

3526

Xrefs:

-

Description:

An attacker can run arbitrary code on the remote computer.
This is because the remote IIS server is running a version of
ActivePerl prior to 5.6.1.630 and has the Check that file
exists option disabled for the perlIS.dll.

Solution: Either upgrade to a version of ActivePerl more
recent than 5.6.1.629 or enable the Check that file exists option.
To enable this option, open up the IIS MMC, right click on a (virtual)
directory in your web server, choose Properties,
click on the Configuration... button, highlight the .plx item,
click Edit, and then check Check that file exists.

More Information: http://www.securityfocus.com/bid/3526

Risk factor : High