[UNIX] Sensitive Information Disclosure Vulnerability Found in SIPS (PHP)

• Previous message: support@securiteam.com: "[NT] Flaw in ISA Server DNS Intrusion Detection Filter Can Cause Denial of Service"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

From: support@securiteam.com
To: list@securiteam.com
Date: 23 Mar 2003 11:44:14 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

In the US?

Contact Beyond Security at our new California office
housewarming rates on automated network vulnerability
scanning. We also welcome ISPs and other resellers!

Please contact us at: 323-882-8286 or ussales@beyondsecurity.com
- - - - - - - - -

  Sensitive Information Disclosure Vulnerability Found in SIPS (PHP)
------------------------------------------------------------------------

SUMMARY

 <http://sourceforge.net/projects/sips/> SIPS (Simple Internet Publishing
System) is an integrated Weblog and link-indexing system written in PHP.

It is aimed at those with access to database-less, PHP-enabled Web servers
who want to run a Weblog site like Slashdot and/or a simple link index
like Yahoo!.

A security vulnerability in the product allows attackers to get access to
privileged information.

DETAILS

Vulnerable versions:
 *SIPS Version 0.22 and prior.

Other versions might be vulnerable too, because the folder naming method
has been kept even in version 0.31.

This vulnerability allows a remote user to access various users' login
information, if the administrator has net carefully set the permissions
(they are not set by default).

The vulnerability relies on the fact that user's information is always
stored in a library defined by his name. By accessing the file "user", a
remote user can read that user's information and password (The password is
MD5 hashed).

For example, the user "foo" will have a URL like this
/sipssys/users/f/foo/user
Password::47bce5c74f589f4867dbd57e9ca9f808
//&#1055;&#1072;&#1088;&#1086;&#1083;&#1100;
&#1079;&#1072;&#1096;&#1080;&#1092;&#1088;&#1086;&#1074;&#1072;&#1085;&#1085;&#1099;&#1081;

&#1072;&#1083;&#1075;&#1086;&#1088;&#1080;&#1090;&#1084;&#1086;&#1084;
MD5.
  Email::test@localhost
  Theme::default

This is taken from the file /htdocs/login.php
 ===========================================================
[...]
   if ($action == "login") {
      if ($username) {
         if (file_exists($config["sipssys"]
"/users/$username[0]/$username/user")) {
            $cryptpass = md5($password);
            if (getUserValue($username, "Password") == $cryptpass) {
               $cryptuser = "$username:$cryptpass";

[...]
 ===========================================================

Exploit Method:
http://[somehost]/[sips_directioy]/sipssys/users/[first_letter_of_UserID]/[UserID]/user

ADDITIONAL INFORMATION

Information was provided by <mailto:r2subj3ct@dwclan.org> subj

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: support@securiteam.com: "[NT] Flaw in ISA Server DNS Intrusion Detection Filter Can Cause Denial of Service"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]