[UNIX] Big Sam (Built-In Guestbook Standalone Module) Contains Multiple Vulnerabilities

From: support@securiteam.com
Date: 03/23/02 

From: support@securiteam.com
To: list@securiteam.com
Date: Sat, 23 Mar 2002 18:14:33 +0100 (CET)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  Big Sam (Built-In Guestbook Standalone Module) Contains Multiple
Vulnerabilities
------------------------------------------------------------------------

SUMMARY

 <http://bigsam.gezzed.net/> Big Sam (Built-In Guestbook Stand-Alone
Module) is a PHP3/4 script guestbook which does not use databases. It is
very simple to set up, very simple to administer, and very accurate.

A vulnerability exists in Big Sam, which may cause extreme usage of system
resources and may cause web root path disclosure.

DETAILS

Vulnerable systems:
Big Sam version 1.1.08 and previous versions

Immune systems:
Big Sam version 1.1.09 and above

The "bigsam_guestbook.php" file is where all the guestbook viewing
operations take place, there is an option to view entries according to
their number in different pages. This is accomplished by using the
"$displayBegin" variable supplied with an integer.

When a user requests a maliciously crafted URL, the script will run as
usual but if the given number is a really large one, the system may run
out of resources in time, or if the "safe_mode" option is "ON" in PHP
configuration of the server, the script might prematurely end giving an
error message, including the web root path.

Exploit:
http://site/bigsam_guestbook.php?displayBegin=9999...9999

If the "safe_mode" option is "ON", a possible error message like the one
below may appear approximately in 30 seconds depending on server
configuration.

"Fatal error: Maximum execution time of 30 seconds exceeded in
home/users/sites/example/bigsam_guestbook.php on line 16"

This information may be used to aid in further "intelligent" attacks
against the host running the vulnerable Big Sam guestbook.

Solution:
The vendor has verified the existence of the vulnerability and fixed this
issue in version 1.1.09

ADDITIONAL INFORMATION

The information has been provided by <mailto:s_alper@hotmail.com> Ahmet
Sabri ALPER.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages