bugtraq - Re: Digital Armaments Security Advisory 02.14.2006: Gallery web-based photo gallery remote file execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <43F4C94F.7070803@menalto.com>
Date: Thu, 16 Feb 2006 10:49:51 -0800
From: Bharat Mediratta <bharat@...alto.com>
To: info@...italarmaments.com
Cc: bugtraq@...urityfocus.com
Subject: Re: Digital Armaments Security Advisory 02.14.2006: Gallery web-based
 photo gallery remote file execution

Thanks to Digital Armaments for the notification and allowing us to rev
up a patch before posting the flaw.  Corrections to the advisory inline
below.

info@...italarmaments.com wrote:
...
> II. Problem Description
> 
> Every user with privileges (who can modify appareance of one
> Gallery's album) can include any file located on the server. This
> vulnerability can be found in util.php. It allows to an attacker to
> read files on the remote system or execute arbitrary PHP code with
> apache privileges if the attacker can upload files.

A user with active admin privileges must be tricked into clicking on a
carefully crafted url in order to set up this attack.  It can only be
used to execute PHP files on the local system, so the attacker must
contrive some other way to get the PHP file onto the server before it
can be used, therefore this advisory is not a "remote file execution" as
mentioned in the subject line.

> V. Solution
> 
> First notification 12.20.2005. 

No first notification was received to our security mailing list.  For
security notifications, please notify security@...lery.menalto.com.
Thank you.

> Second notification 01.14.2006.
> The vendor answered second notification. A new patched version is
> available.

The security fix released is available here:
http://gallery.menalto.com/gallery_1_5_2_pl2_security_release

-Bharat
Gallery Project Lead