Rule:--Sid:1610--Summary:An attempt to access a script (formmail) in the cgi-bin which has knownvulnerabilities.Formmail is a freely available perl script that is used to send datacollected via a form to specified addresses.--Impact:Attempt to gain information about the web-server environment variables.Could also be an attempt to execute commands on the web-server that willexecute with the privilege of the user owning the daemon running theserver. The script may also be used to relay SPAM or to disclose thecontents of files on the host.--Detailed Information:This could be an attempt to gain intelligence about the web-server thatmight be used to further exploit the machine. The environment variablesof the web-server might be retrieved and sent via email to an address ofthe attackers choosing. More importantly this could be an attempt toexecute commands on the web-server. Should this be successful, thecommands would execute with the privileges of the user owning the httpd daemon.--Attack Scenarios:Formmail receives information from a form via an HTTP POST. Thisincludes the email addresses to which the form data is sent. A URI inthe form of a POST to the formmail script could be crafted to sendenvironment variables to a specified email address.--Ease of Attack:Simple. Exploit software is not required.--False Positives:None known.--False Negatives:None Known--Corrective Action:Web-servers should not be allowed to view or execute files and binariesoutside of it's designated web root or cgi-bin. The web-server httpddaemon should be run as a non-privileged user without login access tothe host. The formmail script should be updated to a non-vulnerableversion as soon as possible.--Contributors:Sourcefire Vulnerability Research TeamNigel Houghton <nigel.houghton@sourcefire.com>-- Additional References:--