full-disclosure - STG Security Advisory: [SSA-20041215-18] Vulnerability of uploading files with multiple extensions in phpBB Attachment Mod

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <GKEOJIPDJOHGOEEOIINIOEPOCAAA.advisory@stgsecurity.com>
From: advisory at stgsecurity.com (SSR Team)
Subject: STG Security Advisory: [SSA-20041215-18]
	Vulnerability of uploading files with multiple extensions in
	phpBB Attachment Mod

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

STG Security Advisory: [SSA-20041215-18] Vulnerability of uploading files
with multiple extensions in phpBB Attachment Mod

Revision 1.0
Date Published: 2004-12-15 (KST)
Last Update: 2004-12-15
Disclosed by SSR Team (advisory@...security.com)

Summary
========
phpBB Attachment Mod is file upload module for phpBB. However, an input
validation flaw can cause malicious attackers to run arbitrary commands with
the privilege of the HTTPD process, which is typically run as the nobody
user.

Vulnerability Class
===================
Implementation Error: Input validation flaw

Impact
======
High : arbitrary command execution.

Affected Products
================
Attachment Mod 2.3.10 and prior.

Vendor Status: FIXED
====================
2004-12-08 Vulnerability found.
2004-12-08 Attachment Mod developer notified.
2004-12-13 Update version released.
2004-12-15 Official release.

Details
=======
Apache Mod doesn't implemented to check multiple extensions of uploaded
files, e.g. attack.php.rar, so malicious attackers can upload arbitrary
script files (php, pl, cgi, etc) to a web server. This is originated from a
feature of Apache MIME module (mod_mime), which regards attack.php.rar as a
normal PHP file and execute the file through mod_php module with the
privilege of the HTTPD process.
cf. http://httpd.apache.org/docs/mod/mod_mime.html - "Files with Multiple
Extensions" : it's a feature, not a bug.

Solution
=========
Update to 2.3.11
http://www.opentools.de/board/viewtopic.php?t=3590

Vendor URL
==========
http://www.opentools.de/

Credits
======
Jeremy Bae at STG Security

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQA/AwUBQcDjxD9dVHd/hpsuEQIIBACfYcy/IRJei/mfkfy+KdhQuCjhUbkAnjig
p3OSX1m+9IWd+MoM8lb5IDHS
=DQt1
-----END PGP SIGNATURE-----