[UNIX] Security Vulnerability Found in EUpload

From: support@securiteam.com
Date: 07/31/02 

From: support@securiteam.com
To: list@securiteam.com
Date: Wed, 31 Jul 2002 12:59:40 +0200 (CEST)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  Security Vulnerability Found in EUpload
------------------------------------------------------------------------

SUMMARY

 <http://www.ftls.org/en/examples/cgi/eUpload.shtml> EUpload is a script
that allows people using browsers that are RFC1867 compliant to upload
files directly through their web browser to your server. A security
vulnerability in the product allows attackers find out the password used
for the script's administration mechanism or any other password.

DETAILS

Vulnerable systems:
 * EUpload version 1.0

The password used by the EUpload program is stored in clear text inside a
file called 'password.txt' (by default). The default installation of the
program stores the file in the same directory as the CGI, allowing remote
attackers to request the file directly, revealing to them all the
passwords stored inside the file (including the administrator's password).

Solution:
Change the name of the file ' password.txt' and change the following
configuration in the file 'upload.cgi':
my $PASSWORD_FILE = $DATA_DIR. ' PASSWORD.TXT'

Where 'password.txt' is the name that we will change, for the new one that
we have created.

ADDITIONAL INFORMATION

The information has been provided by <mailto:zero_byte@bigfoot.com>
Zero_Byte.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages