Squid cachemgr.cgi
advICE :Intrusions : 2002594

Summary

An access has been made to the 'cachemgr.cgi' script.

Details

This script is part of the remote management interface for the Squid proxy server. It is installed by default into the standard cgi-bin directory (e.g. /home/httpd/cgi-bin). If the system administrator installs a webserver such as Apache on the system, then this script will be public to the world. A hacker than then use this script to connect to any other machine (on any port).

Action

The biggest danger is in RedHat Linux systems version 6.0 and below. Squid installations based upon these older distributions should be checked to see if this is running. Newer versions of RedHat or other distributions do not put this CGI script in a public directory by default.

Also check squid.conf in order to verify that cachemgr.cgi has a password.

parametric information URL The suspicious URL. accessed Indicates whether the URL was successfully accessed. code The HTTP return code. arg The argument to the GET command (if any).

 
Version appeared: 2.5