bugtraq - Re: Horde Webmail file inclusion proof of concept & patch.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <DC781CE3-364C-4C43-98A2-B0021EA7560D@dgrmm.net>
Date: Fri, 21 Mar 2008 09:55:37 -0500
From: David Morton <mortonda@...mm.net>
To: Ben Klang <bklang@...de.org>
Cc: bugtraq@...urityfocus.com
Subject: Re: Horde Webmail file inclusion proof of concept & patch.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mar 8, 2008, at 1:22 PM, Ben Klang wrote:
> The Horde team has investigated this report and found it to be  
> reproducible, though not exactly as reported.  The SQL example in  
> the original post does prevent the themes from appearing but does  
> not execute the file in question.  It is unclear based on their  
> limited information whether they are using a modified version of  
> Horde or if there were other factors that lead to the behavior  
> reported.  However if a null byte can be inserted into the theme  
> name (for instance when using the LDAP preference backend which  
> stores preference values in Base64 encoding) it does become possible  
> to cause a file to be included and executed.

I'm a bit behind in reading bugtraq but thought I'd throw this in:  We  
had a similar situation sometime back with Maia Mailguard, and the  
null byte thing depends on the platform.  It was reported on a BSD  
system I think, but our Linux systems would not reproduce it.

In any case, the data should be sanitized. :)

David Morton
Maia Mailguard http://www.maiamailguard.com
mortonda@...mm.net

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (Darwin)

iD8DBQFH48xpUy30ODPkzl0RAitiAJ9zWAh79nDx/zT2V5XkKiRufXYapwCgs2Wo
fSEL3bzwgymbhgDdfeRUz6Y=
=X5gF
-----END PGP SIGNATURE-----