Secunia

The Virgil CGI Scanner contains a vulnerability which allows attackers to spawn a shell on the host running Virgil CGI Scanner.

The tar and zielport parameters are not stripped, thus an attacker may inject shell parameters to nc, the following would cause a shell to spawn:

Requesting '/cgi-bin/virgil.cgi?tar=-le/bin/sh' would cause nc to listen for requests and spawn a shell to which an attacker can connect.

Solution
Stop using Virgil CGI Scanner until an update is ready, remember to remove the CGI scripts.
Further details available in Customer Area

Provided and/or discovered by
KALIF research group

Deep Links
Links available in Customer Area