[UNIX] XOOPS Weak File Validation

From: SecuriTeam (support_at_securiteam.com)
Date: 03/23/05

  • Next message: SecuriTeam: "[REVS] Anti Brute Force Resource Metering" 
    To: list@securiteam.com
Date: 23 Mar 2005 10:15:10 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      XOOPS Weak File Validation
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.xoops.org/> XOOPS is an extensible, OO (Object Oriented),
    easy to use dynamic web content management system written in PHP.

    XOOPS does not check if a content of an uploaded file of avatars is a
    valid image, this allows an attacker to upload malicious script files
    which in turn can be used to preform malicious acts.

    DETAILS

    Vulnerable Systems:
     * XOOPS version 2.0.9.2 and prior

    User may upload malicious files containing arbitrary commands posed as
    images through the avatar uploading mechanism if "Allow custom avatar
    upload" is set to "Yes" in "User Info Settings" (the setting is not 'Yes'
    by default).

    This is due to weak file extension validation of the XoopsMediaUploader
    class in file uploader.php, which doesn't check for all the possible
    extensions malicious files can come as:
    if ( preg_match( '/\.(php|cgi|pl|py|asp)$/i', $this->mediaName ) )
    {
       $this->setErrors('Filename rejected');
        return false;
    }

    Workaround:
    Set "Allow custom avatar upload" to "No" in "User Info Settings".

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:pokleyzz@scan-associates.net> pokley .

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[REVS] Anti Brute Force Resource Metering"

    Relevant Pages

    • [NT] Cross Application Scripting in Trend Micros Antivirus Software
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The SecuriTeam alerts list - Free, Accurate, Independent. ... When the product alerts the user of a possible virus, it creates an HTML ...
      (Securiteam)
    • [NT] Microsoft Windows NTFS Improper Handler Closing
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... from a system shutdown, uninitialized data may be visible in files from ...
      (Securiteam)
    • [EXPL] Eudora Attachment Spoof Exploit Revisited
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... present in the newest release of Eudora. ... Can be exploited if there is more than one way into attach: in my setup ...
      (Securiteam)
    • [UNIX] Phorum SQL Injection (userlogin.php)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... An SQL injection vulnerability exists in the 'userlogin.php' script. ... the MD5 hash of the user one character at a time. ...
      (Securiteam)
    • [EXPL] WinAce Temporary File Handling Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Local exploitation of a buffer overflow vulnerability in WinAce allows ... WinAce Temporary File Parsing Buffer Overflow Vulnerability ...
      (Securiteam)