bugtraq - Album.pl Vulnerability - Remote Command Execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 27 Apr 2003 01:50:29 +0700
From: aresu@...en.net
To: bugtraq@...urityfocus.com
Subject: Album.pl Vulnerability - Remote Command Execution

AresU Advisory
04/27/2003

Album.pl Vulnerability

Severity : High (CGI Remote Command Execution)
Systems Affected: Album.pl up to v6.1
Vendor URL: http://perl.bobbitt.ca/album
Vuln Type : CGI Remote Command Execution
Status    : Vendor contacted, new fixed version available
Author    : AresU
Greetz to : Mike B., Bosen, Tioeuy, syzwz, Heltz, eF73, SakitJiwa, nimdA, Br0374l, FreshFirst, Algorithm
All 1ndonesian Security Team (1st)
http://www.bosen.net/releases/
http://bosen.blogspot.com

Summary
=======
album.pl is a popular web photo album application that allows you to simply drop new photo files into a directory, and they will automatically be accessible via the web.
Any user can execute commands with Web Server privileges (normally nobody) when use an alternate configuration file.

Solution
========
Upgrade to a newer album.pl version (at least 6.2)
http://perl.bobbitt.ca/album/album62.zip

Acknowledgments
===============
Vulnerability discovery and advisory by AresU

Vendor Response
===============
Vendor has been contacted and new fixed version is available.

Exploit Code
============
I have refrained from publishing a more functional exploit at this time, 
to delay attacks against album.pl installations.

-----------------------------------------------
This mail sent through http://webmail.bosen.net