lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20050706002502.GA10451@hardened-php.net> Date: Wed Jul 6 01:27:09 2005 From: sesser at hardened-php.net (Stefan Esser) Subject: Advisory 07/2005: Jaws Multiple Remote Code Execution Vulnerabilities -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened-PHP Project www.hardened-php.net -= Security Advisory =- Advisory: Jaws Multiple Remote Code Execution Vulnerabilities Release Date: 2005/07/06 Last Modified: 2005/07/06 Author: Stefan Esser [sesser@...dened-php.net] Application: Jaws <= 0.5.2 Severity: Multiple Security Holes in Jaws allow remote code execution Risk: Critical Vendor Status: Vendor doesn't consider this serious enough References: http://www.hardened-php.net/advisory-072005.php Overview: Quote from http://www.jaws.com.mx "Jaws is a Framework and Content Management System for building dynamic web sites. It aims to be User Friendly giving ease of use and lots of ways to customize web sites, but at the same time is Developer Frendly, it offers a simple and powerful framework to hack your own modules." An audit of Jaws revealed that it uses XML_RPC and is therefore vulnerable to the known eval() hole. Additionally the Blog gadget is vulnerable to a remote URL inclusion vulnerability. The vendor, although we contacted him credits Gulftech for the XML_RPC vulnerability. He also believes, that a remote URL inclusion vulnerability that is only exploitable with register_globals turned on, which is the default on most servers, is not serious. Because of this they released an updated version of Jaws, that is still vulnerable to remote code execution through the Blog gadget. Details: A quick audit of Jaws revealed, that they are using the XMLRPC library. This audit also revealed that the file BlogModel.php of the Blog gadget suffers a remote URL include vulnerability triggered by the global variable 'path'. Unfortunately for the users of Jaws, the vendor believes that a remote URL inclusion vulnerability is not serious and therefore they released an update to Jaws in response to our notification, that only upgrades the bundled XMLRPC library. This means, although they know better the Jaws developers expose their user to a serious security hole in their Blog gadget. Impudent like they are, they are also crediting the XMLRPC finding to Gulftech, although we contacted them. But this is not uncommon. Secunia and some Linux vendors still claim, that Gulftech has informed the PEAR developers about this vulnerability, which is of course a lie. Proof of Concept: The Hardened-PHP Project is not going to release an exploit for this vulnerability to the public. Disclosure Timeline: 05. July 2005 - Contacted jaws vendor via email 05. July 2005 - Vendor releases Jaws 0.5.2 which only upgrades the bundled XML_RPC 06. July 2005 - Public disclosure Recommendation: Because there is actually no fix for this vulnerability we recommend that you simply do not use Jaws at all. Code that does require register_globals turned off to be secure should be avoided. Alternatively you can simply install the Hardening-Patch to stop this and all other remote URL include vulnerabilities. GPG-Key: http://www.hardened-php.net/hardened-php-signature-key.asc pub 1024D/0A864AA1 2004-04-17 Hardened-PHP Signature Key Key fingerprint = 066F A6D0 E57E 9936 9082 7E52 4439 14CC 0A86 4AA1 Copyright 2005 Stefan Esser. All rights reserved. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQFCyykrRDkUzAqGSqERAreJAKDBozvIiKCUQD7B9rNiVbO3TgJNNwCfRy7n IsVdXTnI/l6CXqSIrpBSotw= =5Gdc -----END PGP SIGNATURE-----
Powered by blists - more mailing lists