[UNIX] DCP-Portal Root Path Disclosure

From: support@securiteam.com
Date: 02/17/02 

From: support@securiteam.com
To: list@securiteam.com
Date: Sun, 17 Feb 2002 00:26:38 +0100 (CET)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  DCP-Portal Root Path Disclosure
------------------------------------------------------------------------

SUMMARY

 <http://www.dcp-portal.com> DCP-Portal is a content management system
with advanced features like web-based update, link, file, member
management, poll, calendar, etc. Its main features include an admin panel
to manage the entire site, a smart HTML editor to add news, content, and
announcements, the ability for members to submit news/content and write
reviews, and much more. It is an open-source project, which is also
supported by FreshMeat. A security vulnerability in the product allows
remote attackers to reveal the true path used by the product.

DETAILS

Vulnerable systems:
DCP-Portal versions 4.2, 4.1 final, 4.0 final, 3.7 and probably prior

Immune systems:
DCP-Portal version 4.5

If a user submits a HTTP request for the "add_user.php", the system will
return an error page containing the path to the web root. The remote
attacker may potentially use the disclosed information to aid in further
attacks against the host running the vulnerable software.

Example:
http://www.example.com/add_user.php

This would return;
"Warning: Cannot add header information - headers already sent by (output
started at /home/usr/www.dcp-portal_host/htdocs/add_user.php:11) in
/home/usr/www.dcp-portal_host/htdocs/add_user.php on line 16"

Solution:
Cut the lines 10-11 on add_user.php, and paste them at line 20.

ADDITIONAL INFORMATION

The information has been provided by <mailto:s_alper@hotmail.com> Ahmet
Sabri ALPER.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages