CVE:CVE-2007-3011
CNNVD:CNNVD-200707-062
ServerView是用于进行自动分析和版本维护的资产管理工具。
ServerView的Web接口处理用户数据时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上以Web进程的权限执行任意命令。
DBAsciiAccess CGI脚本提供了ping功能，该脚本Parameterlist参数的Servername子参数给出了所要ping的IP地址，但没有对这个IP地址执行任何检查。如果在IP后添加了拖尾分号，攻击者就可以注入任意shell命令并以Web服务器进程的权限执行。
solution:Upgrade fujitsu serverview to a higher version than 2.50,3.60l98,3.60l99,4.10l11,4.11l11b,4.11l81,4.30.1,4.30.2,4.30.3,4.30.4,4.30.5,4.30.6,4.30.7,4.30.8,4.30.9,4.30.10,4.30.11,4.30.12,4.30.13,4.40.1,4.40.2,4.40.3,4.40.4,4.40.5,4.40.6,4.50.1,4.50.2,4.50.3,4.50.4,4.50.5,4.50.6,4.50.7,4.50.8,and avoid the version 2.50,3.60l98,3.60l99,4.10l11,4.11l11b,4.11l81,4.30.1,4.30.2,4.30.3,4.30.4,4.30.5,4.30.6,4.30.7,4.30.8,4.30.9,4.30.10,4.30.11,4.30.12,4.30.13,4.40.1,4.40.2,4.40.3,4.40.4,4.40.5,4.40.6,4.50.1,4.50.2,4.50.3,4.50.4,4.50.5,4.50.6,4.50.7,4.50.8