full-disclosure - Re: FWD: PhotoPost vBGallery Important Security Bulletin

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 11 Jan 2008 09:06:37 -0600
From: trains <trains@...torunix.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: FWD: PhotoPost vBGallery Important
	Security	Bulletin

Quoting "ad@...poverflow.com" <ad@...poverflow.com>:

>
> http://www.photopost.com/forum/showthread.php?t=134910
> http://www.photopost.com/forum/showthread.php?p=1213648
>
> It's unclear what type of bug is it about, they are refering to an
> apache bug but since all hacks used to access the database it could be a
> SQL injection. This is critical bug.

This is sort of clever, but obvious in hindsight.  If a web site has  
an upload directory that is also readable, it will be vulnerable.   
Normal sysadmin configurations can prevent this exposure.

Upload directories should not be directly viewable.  That was the  
basis for numerous exploits of frontpage systems back in the day.  A  
script should validate the uploaded file and separately move it to a  
viewable directory.

The reason this is an apache bug is because the default install uses  
an insecure setting for php scripts (perl also).

The "AddType" statement for php is normally system-wide, which means  
the web server will execute php scripts that may be found in the  
upload directory.  This can be fixed multiple ways:
    Move the php AddType statement into a <directory> stanza, or
    Set directory options for directories where we would not expect to  
execute things or use a "AddType" statement in the images directory,  
like:
     <Directory /www/htdocs/images>
       Options +IncludesNoExec -ExecCGI
       AddType text/html .php
       <Files ~ "\.php">
          Order allow,deny
          Deny from all
       </Files>
     </Directory>

that should be redundant enough.

tr

-------------------------------------------------
Email solutions, MS Exchange alternatives and extrication,
security services, systems integration.
Contact:    services@...torunix.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/