Nessus Plugin #15622

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

Cherokee remote command execution

Family:

Gain a shell remotely

Category:

infos

Copyright:

This script is Copyright (C) 2004 David Maciejak

Summary:

Checks for version of Cherokee

Version:

$Revision: 1.1 $

Cve_id:

-

Bugtraq_id:

3771, 3773

Xrefs:

-

Description:

The remote host is running Cherokee - a fast and tiny web server.

The remote version of this software is vulnerable to remote
command execution due to a lack of web requests sanitization,
especially shell metacharacters.

Additionally, this version fails to drop root privileges after it binds
to listen port.

A remote attacker may submit a specially crafted web request to
execute arbitrary command on the server with root privileges.

Solution : Upgrade to Cherokee 0.2.7 or newer
Risk factor : High