The 'test-cgi' script contains a flaw that may allow a remote attacker to view arbitrary files. The issue is triggered when submitting a query to the script, which could allow a remote attacker to view arbitrary files resulting in a loss of confidentiality.
Classification
Location:
Remote/Network Access Required
Attack Type:
Information Disclosure
Impact:
Loss of Confidentiality
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
OSVDB:
Web Related
Technical
A script such as 'test-cgi' is fairly common. It is possible that other vendors also ship a script with this name that may be vulnerable.
Solution
Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround: Remove the script from /cgi-bin.
l0pht.com -