📄 ch19.htm
字号:
<HTML>
<HEAD>
<TITLE>Appendix -- E</TITLE>
<META>
</HEAD>
<BODY TEXT="#000000" BGCOLOR="#FFFFFF" LINK="#0000EE" VLINK="#551A8B" ALINK="#CE2910">
<H1><FONT SIZE=6 COLOR=#FF0000>Appendix E</FONT></H1>
<HR>
<P>
<CENTER><B><FONT SIZE=5><A NAME="CONTENTS">CONTENTS</A></FONT></B></CENTER>
<UL>
<LI><A HREF="#SecurityWarningforWindowsNTServersUsingPerl">
Security Warning for Windows NT Servers Using Perl</A>
<LI><A HREF="#NTperlcgibinDanger">
NTperl cgi-bin Danger</A>
<UL>
<LI><A HREF="#SystemsAffected">
Systems Affected:</A>
<LI><A HREF="#Date">
Date:</A>
<LI><A HREF="#Summary">
Summary:</A>
</UL>
<LI><A HREF="#UrgentSecurityAnnouncement">
Urgent Security Announcement</A>
<UL>
<LI><A HREF="#Name">
Name </A>
<LI><A HREF="#Description">
Description </A>
<LI><A HREF="#UseandMisuse">
Use and Misuse </A>
</UL>
</UL>
<HR>
<H2><A NAME="SecurityWarningforWindowsNTServersUsingPerl"><FONT SIZE=5 COLOR=#FF0000>
Security Warning for Windows NT Servers Using Perl</FONT></A></H2>
<P>
When installing Perl on Windows NT, it is very important to place
the perl.exe in any place other than your CGI bin. The details
of this problem and how to correct it are detailed here in an
announcement from Tom Christenson's Web site, which includes a
download of Latro, a program which you can use to check the security
of Perl on your NT server. For more information about this security
problem please check:
<BLOCKQUOTE>
<PRE>
<B><A HREF="javascript:if(confirm('http://www.perl.com/perl/news/latro-announce.html \n\nThis file was not retrieved by Teleport Pro, because it is addressed on a domain or path outside the boundaries set for its Starting Address. \n\nDo you want to open it from the server?'))window.location='http://www.perl.com/perl/news/latro-announce.html'" tppabs="http://www.perl.com/perl/news/latro-announce.html">http://www.perl.com/perl/news/latro-announce.html</A></B>
</PRE>
</BLOCKQUOTE>
<H2><A NAME="NTperlcgibinDanger"><FONT SIZE=5 COLOR=#FF0000>
NTperl cgi-bin Danger</FONT></A></H2>
<H3><A NAME="SystemsAffected">
Systems Affected:</A></H3>
<UL>
<LI>Windows-NT web-servers
<LI>NT web-servers with a PERL.EXE (or any other command language
interpreter executable) file in the \CGI-BIN\ directory.
<LI>Other systems too(?)-Other systems are possibly affected by
this. For example: DOS PERL.EXE takes the -e switch too.
On the other hand I don't know of any DOS boxes running as
websites... ;-)
</UL>
<H3><A NAME="Date">
Date:</A></H3>
<P>
Where possible references to older documents (e-mail) are dated.
<H3><A NAME="Summary">
Summary:</A></H3>
<P>
Starting at about mid December 1995 Tom Christiansen (of Perl
fame) posted a warning to one or more mailing lists devoted to
the Perl programming language. The warning was about the dangers
of placing your PERL.EXE file within your \CGI-BIN\ directory
on a Windows-NT web-server. This is a very unsafe thing to do!
You can safely run cgi-bin scripts written in Perl on an NT Web
server. There are, in fact, several secure ways to do so. This
document describes a few of the things you can do to ensure system
security. This is not a document about the programming strategies
required to write secure cgi-bin perl scripts in general. Please
note carefully that while this document focuses on PERL.EXE, it
is true that putting any <INTERPRETER>.EXE into your \CGI-BIN\
will open your webserver up to trouble, big trouble. This includes
BASH.EXE, CSH.EXE, KSH.EXE, JAVA.EXE, PYTHON.EXE, SH.EXE, TCLSH.EXE,
TCSH.EXE, VCL.EXE, WISH.EXE, ..., etc. This potential trouble
is due in part to the cgi-bin mechanism (which pass arguments
to an interpreter on command line or via environment variables).
If the whole interpreter is sitting in \CGI-BIN\, then any commands
at all may be passed to it for execution. In other words, if you
do not allow your system or your webserver software to determine
something about what arguments it takes and how it handles them
(i.e., a cgi-bin script that talks to the interpreter only if
it is safe to do so) then the whole Internet can talk to your
command interpreter and feed it evil commands like DELETE *.*;
YES;.
<H2><A NAME="UrgentSecurityAnnouncement"><FONT SIZE=5 COLOR=#FF0000>
Urgent Security Announcement</FONT></A></H2>
<P>
How'd you like to let anyone anywhere run any program they feel
like on your system, even sending you new ones of their own devising?
Sound frightening? Well, that's what's going on out there.
<P>
Despite months of lobbying corporations, individuals, and the
net at large about the perl.exe?FMH.pl problem, it continues to
get worse. In the spirit of the Satan network checker, here's
something that will find out whether you have the problem. It's
called Latro, a program anyone can use to run any program they
feel like on any system so unfortunate as to have ignored those
warnings. If I hadn't written it, someone else would have. You
may argue that I've just given a lockpicking kit to the unwashed
masses. Perhaps this is so, but far better that everyone should
have the same resources at their disposal than that merely the
thieves should have them. This way at least the locks might get
fixed.
<P>
Already several people have posted to USENET about how one can
use Alta Vista to find these sites. It's only a matter of time
before these sites get, um, visited. Hopefully someone will construct
a list of these and notify them. This is, of course, just a fraction
of the vulnerable sites. Let's clean it up out there, guys. Nefarious
users could even ship over their own PC binaries and run them
on your system, which means that if you aren't careful, they might
do something useful like forcibly upgrade you to Linux. Of course,
then the perl.exe?FMH.pl travesty magically goes away, along with
a whole lot of other problems. :-)<BR>
<P>
<CENTER>
<TABLE BORDERCOLOR=#000000 BORDER=1 WIDTH=80%>
<TR VALIGN=TOP><TD WIDTH=590><B>NOTE</B></TD></TR>
<TR VALIGN=TOP><TD WIDTH=590>
<BLOCKQUOTE>
<I>This problem probably affects only amateur and/or commercial machines running those cursèd spawn of CP/M that Microsoft (and no one else) calls operating systems. Professional software development systems like Unix and Plan9 should be largely
unaffected. Paradoxically enough, Apple systems running their native systems should also be ok because the setup is so different. But please never underestimate the power of human stupidity when it comes to using technology they don't understand. There are
also loads of sites out there with other interpreters than Perl in their cgi-bins, including shells, tcl, python, etc. This has got to stop. </I>
</BLOCKQUOTE>
</TD></TR>
</TABLE></CENTER>
<P>
<P>
CERT has been notified of the issue, and has released a report
about the problem.
<H3><A NAME="Name">
Name </A></H3>
<P>
latrodectus cyberneticus-probe web for insecure Perl installations
<H4>Synopsis </H4>
<P>
Via command line arguments:
<BLOCKQUOTE>
<PRE>
<B>latro host1 //host2/bincgi //host3/bincgi/badperl</B>
</PRE>
</BLOCKQUOTE>
<P>
or via STDIN:
<BLOCKQUOTE>
<PRE>
<B>sed 's/ .*//' access_log | sort -u | latro</B>
</PRE>
</BLOCKQUOTE>
<H3><A NAME="Description">
Description </A></H3>
<P>
Latro is designed to probe whether the site or sites you control
have been compromised by the insanely idiotic practice of placing
a perl executable in the cgi-bin. If you have ever seen anyone
post a URL like:
<BLOCKQUOTE>
<PRE>
<B>http://dummy.org/cgi-bin/perl.exe?FMH.pl</B>
</PRE>
</BLOCKQUOTE>
<P>
then you know they have the problem. This is pathetically pervasive
amongst (horrifically mismanaged) sub-Unix web sites.
<H3><A NAME="UseandMisuse">
Use and Misuse </A></H3>
<P>
<B>Robert Heinlein once wrote: </B>
<P>
Stupidity cannot be cured with money, or through education, or
by legislation. Stupidity is not a sin, the victim can't help
being stupid. But stupidity is the only universal capital crime;
the sentence is death, there is no appeal, and execution is carried
out automatically and without pity.
<P>
Consider this program such execution, or at least the threat thereof.
You can do very evil things with this program. Very evil things.
You can execute ANYTHING YOU WANT on their site, even sending
over your own binaries instead of just Perl code. Please don't
do anything (too) wicked. When you find such sites, please do
the responsible and professional thing and mail their cluefully
challenged webmaster about the problem. My goal with this program
is to shake up the web a little bit now lest a real poison spider
should someday rip it to shreds and blame Perl. It's not Perl's
fault. It's the idiocy of the PC web sites-and the vendors and
docs that tell them to do this ineffably idiotic and evil thing.
<HR>
<CENTER><P><A HREF="ch18.htm" tppabs="http://210.32.137.15/ebook/PC%20Magazine%20Programming%20Perl%205.0%20CGI%20Web%20Pages%20for%20Microsoft%20Windows%20NT/ch18.htm"><IMG SRC="PC.GIF" tppabs="http://210.32.137.15/ebook/PC%20Magazine%20Programming%20Perl%205.0%20CGI%20Web%20Pages%20for%20Microsoft%20Windows%20NT/PC.GIF" BORDER=0 HEIGHT=88 WIDTH=140></A>
<A HREF="#CONTENTS"><IMG SRC="CC.GIF" tppabs="http://210.32.137.15/ebook/PC%20Magazine%20Programming%20Perl%205.0%20CGI%20Web%20Pages%20for%20Microsoft%20Windows%20NT/CC.GIF" BORDER=0 HEIGHT=88 WIDTH=140></A>
<A HREF="contents.htm" tppabs="http://210.32.137.15/ebook/PC%20Magazine%20Programming%20Perl%205.0%20CGI%20Web%20Pages%20for%20Microsoft%20Windows%20NT/contents.htm"><IMG SRC="HB.GIF" tppabs="http://210.32.137.15/ebook/PC%20Magazine%20Programming%20Perl%205.0%20CGI%20Web%20Pages%20for%20Microsoft%20Windows%20NT/HB.GIF" BORDER=0 HEIGHT=88 WIDTH=140></A>
<A HREF="ch20.htm" tppabs="http://210.32.137.15/ebook/PC%20Magazine%20Programming%20Perl%205.0%20CGI%20Web%20Pages%20for%20Microsoft%20Windows%20NT/ch20.htm"><IMG SRC="NC.GIF" tppabs="http://210.32.137.15/ebook/PC%20Magazine%20Programming%20Perl%205.0%20CGI%20Web%20Pages%20for%20Microsoft%20Windows%20NT/NC.GIF" BORDER=0 HEIGHT=88 WIDTH=140></A>
<HR WIDTH="100%"></P></CENTER>
</BODY>
</HTML>
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -