GNU GLOBAL - News: GLOBAL Security Advisory
GLOBAL Security Advisory
Item posted by Shigio YAMAGUCHI <shigio> on Thu 05 Jun 2003 04:15:05 AM UTC.
Hello hackers,
A security hole was found in CGI program generaged by htags(1).
Please understand current situation and take a measures to meet
the situation.
[The versions which include security hole]
The following version include the security hole.
GLOBAL-4.4, 4.5, 4.5.1, 4.5.2
If you use above version and use the -f option of htags(1) with the
grep or idutils search function effective, please stop publishing
hypertext generated by htags(1), replace your GLOBAL with the fixed
version 4.5.3 and regenerate hypertext before publishing.
[The contents of the security hole]
Almost commands are world-executable by form if you publish
the hypertext generated by htags using the -f option and with
the configuration variable enable_grep or enable_idutils
specified.
If you have some questions, please mail to me (shigio@gnu.org).
Thank you for your cooporation.
Powered by Savane 3.14-9aa3.
Corresponding source code