[UNIX] SysCP Code Execution

From: SecuriTeam (support_at_securiteam.com)
Date: 08/10/05

  • Next message: SecuriTeam: "[UNIX] Lantonix Secure Console Multiple Vulnerabilities (Buffer Overflow, Directory Traversal, Multiple Privileges Escalation)" 
    To: list@securiteam.com
Date: 10 Aug 2005 14:31:32 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      SysCP Code Execution
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www.syscp.de/> SysCP, the System Control Panel is a server
    administration tool which enables an internet service provider to give
    their customers a web-based application to administrate their email
    addresses, their subdomains etc."

    By using global variables, attackers can inject code into SysCP and cause
    it to execute arbitrary code on the system.

    DETAILS

    Vulnerable Systems:
     * SysCP version 1.2.10 and prior

    Immune Systems:
     * SysCP version 1.2.11

    With the PHP configuration flag "register_globals On" (which is still the
    case for a large installation base), a number of variables of SysCP can be
    injected, leading to the execution of arbitrary remote code, which can
    also be included from a remote server. This can lead to complete system
    compromise, and setting backdoors, steal information, or change system
    settings.

    Disclosure Timeline:
    18. July 2005 - Initial vendor contact
    23. July 2005 - PoC disclosed to vendor
    04. August 2005 - Vendor has released updated version
    09. August 2005 - public disclosure

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:christopher.kunz@hardened-php.net> Christopher Kunz.
    The original article can be found at:
    <http://www.hardened-php.net/advisory_132005.64.html>
    http://www.hardened-php.net/advisory_132005.64.html

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] Lantonix Secure Console Multiple Vulnerabilities (Buffer Overflow, Directory Traversal, Multiple Privileges Escalation)"

    Relevant Pages