GEN:SID 1:1149
Message WEB-CGI count.cgi access
Summary This event is generated when an attempt is made to access Wwwcount
(count.cgi), a very popular CGI program used to track website usage.
Impact Will allow access as with the privileges of the user running the
process.
Detailed Information In particular, it enumerates the number of hits on given webpages and
increments them on a 'counter'. In October of 1997 two remotely
exploitable problems were discovered with this program. The first
problem was somewhat innocuous in that it only allowed remote users to
view .GIF files they were not supposed to have access to. This may be
dangerous if the site contains sensitive data in .GIF files such as
demographic/financial data in charts etc.

The second and most serious problem is a buffer overflow in QUERY_STRING
enviroment variable handled by the program. In essence a remote user can
send an overloy long query to the program and overflow a buffer in order
to execute their own commands as whatever privilege level the program is
running as.
Affected Systems  
Attack Scenarios Simple HTTP GET request.
Ease of Attack Simple. Exploit code available
Corrective Action If you are running version 2.3 of Wwwcount it is suggested you upgrade
immediately. In the meantime you may wish to consider removing the
execution bit on this program. Versions 2.4 and above of this software
are available at:

http://www.fccc.edu/users/muquit/Count.html
Additional References Bugtraq:
http://securityfocus.com/bid/128/info/

CVE:
http://icat.nist.gov/icat.cfm?cvename=CVE-1999-0021
Rule References bugtraq: 128
cve: 1999-0021
nessus: 10049