| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 16 Feb 2006 10:49:51 -0800 From: Bharat Mediratta <bharat@...alto.com> To: info@...italarmaments.com Cc: bugtraq@...urityfocus.com Subject: Re: Digital Armaments Security Advisory 02.14.2006: Gallery web-based photo gallery remote file execution Thanks to Digital Armaments for the notification and allowing us to rev up a patch before posting the flaw. Corrections to the advisory inline below. info@...italarmaments.com wrote: ... > II. Problem Description > > Every user with privileges (who can modify appareance of one > Gallery's album) can include any file located on the server. This > vulnerability can be found in util.php. It allows to an attacker to > read files on the remote system or execute arbitrary PHP code with > apache privileges if the attacker can upload files. A user with active admin privileges must be tricked into clicking on a carefully crafted url in order to set up this attack. It can only be used to execute PHP files on the local system, so the attacker must contrive some other way to get the PHP file onto the server before it can be used, therefore this advisory is not a "remote file execution" as mentioned in the subject line. > V. Solution > > First notification 12.20.2005. No first notification was received to our security mailing list. For security notifications, please notify security@...lery.menalto.com. Thank you. > Second notification 01.14.2006. > The vendor answered second notification. A new patched version is > available. The security fix released is available here: http://gallery.menalto.com/gallery_1_5_2_pl2_security_release -Bharat Gallery Project Lead
Powered by blists - more mailing lists