CVE-2000-0322
published 2000-04-24CVE-2000-0322: The passwd.php3 CGI script in the Red Hat Piranha Virtual Server Package allows local users to execute arbitrary commands via shell metacharacters.
PriorityP266critical10CVSS 2.0
AVNACLAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
41.63%
98.5th percentile
The passwd.php3 CGI script in the Red Hat Piranha Virtual Server Package allows local users to execute arbitrary commands via shell metacharacters.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | linux | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor HTTP GET requests targeting /piranha/secure/passwd.php3 with shell metacharacters (e.g., semicolons) in the try1 or try2 query parameters, which are the injection points for arbitrary command execution. ↗
- →Alert on HTTP Basic Authentication attempts to the /piranha/secure/ path using the default credentials piranha:q, which were exploited in the wild. ↗
- →Successful exploitation results in a 200 response containing the string 'The passwords you supplied match'; correlate this response with suspicious query parameters as a post-exploitation indicator. ↗
- ·The Metasploit module uses the PrintfPHPMagicQuotes encoder because PHP's magic_quotes_gpc is on by default in the target environment, causing escaping of single and double quotes. Detection rules must account for encoded payloads that avoid these characters. ↗
- ·The exploit requires prior authentication (HTTP Basic Auth) to the /piranha/secure/ path; unauthenticated attempts will receive a 401 response. Detection should cover both the auth attempt and the subsequent command injection request. ↗
- ·Commands are executed as the Apache user account (nobody), not as root. Post-exploitation process monitoring should focus on the 'nobody' user spawning unexpected child processes. ↗
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck10.0CRITICAL
vendor_redhat10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
security flaw
vendor_redhat·2000-04-24·CVSS 10.0
CVE-2000-0322 [CRITICAL] security flaw
security flaw
The passwd.php3 CGI script in the Red Hat Piranha Virtual Server Package allows local users to execute arbitrary commands via shell metacharacters.
Statement: This issue was fixed in the following product:
- Red Hat Linux 6.2 - RHSA-2000:014 (2000-04-24)
GHSA
GHSA-cxxx-c74v-hjm6: The passwd
ghsa_unreviewed·2022-04-30
CVE-2000-0322 [HIGH] GHSA-cxxx-c74v-hjm6: The passwd
The passwd.php3 CGI script in the Red Hat Piranha Virtual Server Package allows local users to execute arbitrary commands via shell metacharacters.
VulnCheck
Red Hat linux Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulncheck·2000·CVSS 10.0
CVE-2000-0322 [CRITICAL] Red Hat linux Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Red Hat linux Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The passwd.php3 CGI script in the Red Hat Piranha Virtual Server Package allows local users to execute arbitrary commands via shell metacharacters.
Affected: Red Hat linux
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://packetstormsecurity.com/files/86303/RedHat-Piranha-Virtual-Server-Package-passwd.php3-Arbitrary-Command-Execution.html
No detection rules found.
Exploit-DB
RedHat Piranha Virtual Server Package - 'passwd.php3' Arbitrary Command Execution (Metasploit)
exploitdb·2010-10-18
CVE-2000-0322 RedHat Piranha Virtual Server Package - 'passwd.php3' Arbitrary Command Execution (Metasploit)
RedHat Piranha Virtual Server Package - 'passwd.php3' Arbitrary Command Execution (Metasploit)
---
##
# $Id: piranha_passwd_exec.rb 10729 2010-10-18 15:41:13Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 [ /Apache/ ] }
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'RedHat Piranha Virtual Server Package passwd.php3 Arbitrary Command Execution',
'Description' => %q{
This module abuses two flaws - a metacharacter injection vulnerability in the
HTTP management server of RedHat
Exploit-DB
Microsoft Internet Explorer 4 / Outlook 2000/5.5 - 'MSHTML.dll' Crash
exploitdb·2001-01-15
CVE-2001-0322 Microsoft Internet Explorer 4 / Outlook 2000/5.5 - 'MSHTML.dll' Crash
Microsoft Internet Explorer 4 / Outlook 2000/5.5 - 'MSHTML.dll' Crash
---
source: https://www.securityfocus.com/bid/2202/info
MSHTML.DLL is the shared library for parsing HTML in Internet Explorer and related applications. It may be possible for an attacker to crash this library remotely and cause a denial of service with special Jscript code.
This bug involves Jscript's ability to handle multiple window objects. If a window object is deleted after it receives data and then re-initalized, the library will reportedly crash. This behavior has been attributed to a stack overflow by its discoverer. It is reportedly not exploitable in any way that may permit an attacker to gain access to the victim host.
Microsoft has acknowledged this bug and it should be fixed in the next service pack.
Metasploit
RedHat Piranha Virtual Server Package passwd.php3 Arbitrary Command Execution
metasploit
RedHat Piranha Virtual Server Package passwd.php3 Arbitrary Command Execution
RedHat Piranha Virtual Server Package passwd.php3 Arbitrary Command Execution
This module abuses two flaws - a metacharacter injection vulnerability in the HTTP management server of RedHat 6.2 systems running the Piranha LVS cluster service and GUI (rpm packages: piranha and piranha-gui). The vulnerability allows an authenticated attacker to execute arbitrary commands as the Apache user account (nobody) within the /piranha/secure/passwd.php3 script. The package installs with a default user and password of piranha:q which was exploited in the wild.
http://www.redhat.com/support/errata/RHSA-2000-014.htmlhttp://www.securityfocus.com/bid/1149http://www.securityfocus.com/templates/archive.pike?list=1&msg=Enip.BSO.23.0004241601140.28851-100000%40www.whitehats.comhttp://www.redhat.com/support/errata/RHSA-2000-014.htmlhttp://www.securityfocus.com/bid/1149http://www.securityfocus.com/templates/archive.pike?list=1&msg=Enip.BSO.23.0004241601140.28851-100000%40www.whitehats.com
2000-04-24
Published
Exploited in the wild