full-disclosure - Re: Drupal Imagefield Module Multiple Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20430.1233245858@turing-police.cc.vt.edu>
Date: Thu, 29 Jan 2009 11:17:38 -0500
From: Valdis.Kletnieks@...edu
To: "Justin C. Klein Keane" <justin@...irish.net>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Drupal Imagefield Module Multiple
	Vulnerabilities

On Thu, 29 Jan 2009 09:15:46 EST, "Justin C. Klein Keane" said:

> Two flaws exist in this module.  The first flaw allows for an attacker
> to upload arbitrary files to the filesystem.  The vulnerability allows
> attackers to upload arbitrary files in place of the 'Default image'
> specified in the Imagefield specifications for a content type field.
....
> Attackers must be authenticated with an account that has 'administer
> content types' permissions.

Umm.. what's the risk here?  Does the flaw allow the attacker to upload
files that wouldn't be permitted even as the authorized account?  Seems if
they can administer content types, they can drop pretty much whatever they
want onto the server (possibly limited as to where in the tree though), and
all this does is let them drop stuff outside said tree?

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/