Bugtraqmailing list archives
STG Security Advisory: [SSA-20041215-15] Vulnerability of uploading files with multiple extensions in MoniWiki
From: <advisory () stgsecurity com>
Date: 15 Dec 2004 18:13:01 -0000
STG Security Advisory: [SSA-20041215-15] Vulnerability of uploading fileswith multiple extensions in MoniWikiRevision 1.0Date Published: 2004-12-15 (KST)Last Update: 2004-12-15Disclosed by SSR Team (advisory () stgsecurity com)Summary========MoniWiki is a wiki web application used by many Korean Linux users. However,an input validation flaw can cause malicious attackers to run arbitrarycommands with the privilege of the HTTPD process, which is typically run asthe nobody user.Vulnerability Class===================Implementation Error: Input validation flawImpact======High : arbitrary command execution.Affected Products================MoniWiki 1.0.9.2 and prior.Vendor Status: FIXED====================2004-12-08 Vulnerability found.2004-12-08 MoniWiki developer notified.2004-12-09 First patch updated in CVS but didn't solve the problem.2004-12-09 Second patch updated in CVS.2004-12-15 Official release.Details=======MoniWiki doesn't implemented in "UploadFile.php" to check multipleextensions of uploaded files, e.g. attack.php.hwp, so malicious attackerscan upload arbitrary script files (php, pl, cgi, etc) to a web server. Thisis originated from a feature of Apache MIME module (mod_mime), which regardsattack.php.hwp as a normal PHP file and execute the file through mod_phpmodule with the privilege of the HTTPD process.cf.http://httpd.apache.org/docs/mod/mod_mime.html - "Files with MultipleExtensions" : it's a feature, not a bug.Solution=========Update to patched version of UploadFile.phphttp://kldp.net/forum/forum.php?forum_id=2085Vendor URL==========http://kldp.net/projects/moniwiki/Credits======Jeremy Bae at STG Security
Current thread:
- STG Security Advisory: [SSA-20041215-15] Vulnerability of uploading files with multiple extensions in MoniWikiadvisory (Dec 15)