[Full-Disclosure] STG Security Advisory: [SSA-20030701-03] ChangshinSoft ezTrans Server File Download Vulnerability

From: SSR Team (advisory_at_stgsecurity.com)
Date: 07/08/03

  • Next message: Richard M. Smith: "RE: [Full-Disclosure] Internet Explorer 6 DoS Bug" 
    To: "SecurityTracker" <bugs@securitytracker.com>, "SecuriTeam" <news@securiteam.com>, "Secunia" <vuln@secunia.com>, "Packet Storm Security" <submissions@packetstormsecurity.org>, "Full Disclosure" <full-disclosure@lists.netsys.com>, "BugTraq" <bugtrack@securityfocus.com>
Date: Tue, 8 Jul 2003 21:05:30 +0900

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    STG Security Advisory: [SSA-20030701-03] ChangshinSoft ezTrans Server File
    Download Vulnerability

    Revision 1.1
    Date Published: 2003-07-08 (KST)
    Last Update: 2003-07-08
    Disclosed by SSR Team (advisory@stgsecurity.com)

    Synopsis
    ========
    ezTrans Server, used by famous portal sites in Korea, is a real-time
    Korean-to-Japanese and Japanese-to-Korean translator made by ChangshinSoft.
    For inappropriate input validation in a file download module of ezTrans
    Server, an attacker can download files accessible to web server privilege.

    Vulnerability Class
    ===================
    Implementation Error: Inappropriate Input Validation

    Details
    =======
    For inappropriate input validation in a file download module of ezTrans
    Server, an attacker can download files accessible to web server privilege.

    Proof of Concept:
    http://[victim
    site]/question/crm/download.php?filename=../../../../../../../../../../../..
    /etc/passwd

    http://[victim
    site]/download.php?filename=../../../../../../../../../../../../../etc/passw
    d

    Exploiting this vulnerability, an attacker can download files which
    include critical information and damage a portal site with another
    vulnerable web application.

    Impact
    ======
    An attacker can read critical information on the victim site.
    Using this vulnerability and exploiting another vulnerable web applications,
    a malicious attacker can dispossess a web server.

    Workaround
    ==========
    It's very difficult to program secure web applications in PHP. Nonetheless
    you can minimize security problems by setting php.ini up appropriately.

    To minimize the effects of this vulnerability, we recommend following
    workarounds.

    1. Turn register_globals option in php.ini OFF. For detailed information,
       refer to below sites.
    2. Delete the vulnerable download.php and use static link to a file
       to download inside your HTML source.

    References
    Study in Scarlet - http://www.securereality.com.au/studyinscarlet.txt
    Securing PHP: Step-by-step - http://www.securityfocus.com/infocus/1706

    Affected Products
    ================
    ezTrans Server

    Vendor Status: FIXED
    ===================
    2003-06-24 CSSoft notified.
    2003-06-26 Second attempt at vendor and system administrator contact.
    2003-07-02 Third attempt at vendor contact.
    2003-07-04 Forth attempt at vendor contact.
    2003-07-04 Vendor replied.
    2003-07-04 Last attempt at vendor contact.
    2003-07-04 Vendor fixed.
    2003-07-08 Public disclosure

    Credits
    ======
    Jeremy Bae at STG Security SSR Team

    About STG Security
    =================
    STG Security Inc. is a affiliated company of STG Group which has its head
    office in the States founded in march 2000. Its core business area is
    professional penetration testing, security code review and BS7799 consulting
    services.

    http://www.stgsecurity.com/

    Phone +82-2-6333-4500
    FAX +82-2-6333-4545

    -----BEGIN PGP SIGNATURE-----
    Version: PGP 8.0

    iQA/AwUBPwqzUT9dVHd/hpsuEQKD/gCfYNKIf1bGN+7rnCXVlCXvOg5ZbYEAoKQC
    u8a2PadV9zd17EIQDQUuVU1y
    =pnDg
    -----END PGP SIGNATURE-----

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Richard M. Smith: "RE: [Full-Disclosure] Internet Explorer 6 DoS Bug"

    Relevant Pages