bugtraq - Re: Invision Vulnerabilities, including remote code execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <200604261941.k3QJfOgD004073@cairo.mitre.org>
Date: Wed, 26 Apr 2006 15:41:24 -0400 (EDT)
From: "Steven M. Christey" <coley@...re.org>
To: bugtraq@...urityfocus.com
Subject: Re: Invision Vulnerabilities, including remote code execution

>  sources/action_public/search.php line 1261
>  $this->output = preg_replace(
>  "#(value=[\"']{$this->ipsclass->input['lastdate']}[\"'])#i", "\\1
>  selected='selected'",
>  $this->output );
>
>...
>an #e modifier is added and then %00 used which will be parsed as a
>null byte and truncate the string thus removing the original )#i
>part.

This is a very interesting bug: modifying a regular expression in a
way that accesses the execution functionality.

In general, regexp hacking seems to be a fruitful area for research.
As another example, null characters have been used to bypass
security-relevant regexp checks.

As "input validation" becomes more frequent, it seems likely that
these kinds of vulns will be introduced more often.  Other languages
with rich regexp capabilities might be subject to similar issues.

- Steve