[UNIX] "UNIX Manual" PHP-Script Allows Arbitrary Code Execution

From: support@securiteam.com
Date: 12/18/01 

From: support@securiteam.com
To: list@securiteam.com
Date: Tue, 18 Dec 2001 15:48:58 +0100 (CET)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  "UNIX Manual" PHP-Script Allows Arbitrary Code Execution
------------------------------------------------------------------------

SUMMARY

"UNIX Manual" is a PHP-Script by Marcus S. Xenakis, which allows users to
view the UNIX man-Pages via Browser. This script does not adequately
filter dangerous characters which results in arbitrary command execution.

DETAILS

It seems like the script pipes requests directly to the shell without
checking for insecure characters such as ";".

Example:
 - Go to a Page using this script.
 - Enter in the textbox:
; ls -l

This would result in "Unix Manual" showing you the contents of the
directory in which the script is located.

Impact:
By using this bug, it is possible for an attacker to execute every
UNIX-command he wants with HTTP-Daemon-Rights.

ADDITIONAL INFORMATION

The information has been provided by <mailto:genius28@gmx.de> Florian
Hobelsberger / BlueScreen.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NEWS] Active! mail Script Execution Vulnerability
    ... HREF="http://www.transware.co.jp/ ">TransWARECo. is a web-based e-mail ... malicious <script> tag in the header, the script will be executed upon the ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)
  • [TOOL] NTAL, Network Traffic Analyzer
    ... you write a script ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)
  • [UNIX] vBulletin XSS Injection Vulnerability (perpage)
    ... the script will output an error message [Due to script doesn't ... checks on inputs and filter it], printing the query and revealing its ... This bulletin is sent to members of the SecuriTeam mailing list. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)
  • [NEWS] XSS Vulnerability Found in Cisco Website
    ... A Cross Site Scripting vulnerability has been discovered in Cisco systems' ... the script will be executed (on the client's ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)
  • [UNIX] vBulletin XSS Injection Vulnerability (perpage)
    ... Vulnerable systems: ... * Jelsoft vBulletin 2.2.9 Release Candidate and prior ... the script will output an error message [Due to script doesn't ... This bulletin is sent to members of the SecuriTeam mailing list. ...
    (Securiteam)