[UNIX] SysCP Code Execution

From: SecuriTeam (support_at_securiteam.com)
Date: 08/10/05

  • Next message: SecuriTeam: "[UNIX] Lantonix Secure Console Multiple Vulnerabilities (Buffer Overflow, Directory Traversal, Multiple Privileges Escalation)" 
    To: list@securiteam.com
Date: 10 Aug 2005 14:31:32 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      SysCP Code Execution
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www.syscp.de/> SysCP, the System Control Panel is a server
    administration tool which enables an internet service provider to give
    their customers a web-based application to administrate their email
    addresses, their subdomains etc."

    By using global variables, attackers can inject code into SysCP and cause
    it to execute arbitrary code on the system.

    DETAILS

    Vulnerable Systems:
     * SysCP version 1.2.10 and prior

    Immune Systems:
     * SysCP version 1.2.11

    With the PHP configuration flag "register_globals On" (which is still the
    case for a large installation base), a number of variables of SysCP can be
    injected, leading to the execution of arbitrary remote code, which can
    also be included from a remote server. This can lead to complete system
    compromise, and setting backdoors, steal information, or change system
    settings.

    Disclosure Timeline:
    18. July 2005 - Initial vendor contact
    23. July 2005 - PoC disclosed to vendor
    04. August 2005 - Vendor has released updated version
    09. August 2005 - public disclosure

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:christopher.kunz@hardened-php.net> Christopher Kunz.
    The original article can be found at:
    <http://www.hardened-php.net/advisory_132005.64.html>
    http://www.hardened-php.net/advisory_132005.64.html

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] Lantonix Secure Console Multiple Vulnerabilities (Buffer Overflow, Directory Traversal, Multiple Privileges Escalation)"

    Relevant Pages

    • [NT] w3wp DoS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... 1/12/2006 - Vendor requested for additional info ... recv(conn_socket, szBuffer, 256, 0); ...
      (Securiteam)
    • [NT] Trend Micro HouseCall ActiveX Control Arbitrary Code Execution
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Trend Micro HouseCall ActiveX Control Arbitrary Code Execution ... The vulnerability is caused due to an implementation error within the ... 18/08/2008 - Vendor notified. ...
      (Securiteam)
    • [NT] Microsoft Hierarchical FlexGrid Control Integer Overflows (MS08-070)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Microsoft Hierarchical FlexGrid Control Integer Overflows ... 28/08/2007 - Vendor notified. ...
      (Securiteam)
    • [Full-disclosure] Advisory 13/2005: Remote code execution in SysCP
      ... Vendor Status: Vendor has released an updated version ... ded from a remote server. ... SysCP needs the MySQL root password to perform some of its functionality, ... Disclosure Timeline: ...
      (Full-Disclosure)
    • [NT] CA ARCserve Backup RPC "handle_t" Argument Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... CA ARCserve Backup RPC "handle_t" Argument Vulnerability ... 24/10/2007 - Vendor notified. ... 21/05/2008 - Vendor notifies expected release in October 2008. ...
      (Securiteam)