AOH :: HP Unsorted S :: TB13058.HTM

SiteBar 3.3.8 - serious holes



Serious holes affecting SiteBar 3.3.8
Serious holes affecting SiteBar 3.3.8



--Boundary-00=_hu7FHBLIZSCENnT
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

All,

As a result of a short security audit of SiteBar, a number of security holes 
were found.  The holes included code execution, a malicious redirect and 
multiple cases of Javascript injection.

After liasing with the developers, the holes have been patched.  Attached are 
the advisory and patch relating to these flaws.

CVEs open already relating to this audit:

* CVE-2006-3320 (Javascript injection) - previously reported by other parties 
but not resolved and so included for completeness

* CVE-2007-5492 (code execution) - first reported in my attached advisory to 
the vendor, independently rediscovered by Robert Buchholz of Gentoo whilst 
auditing the differences between the patched and unpatched versions (3.3.8 vs 
3.3.9)

* CVE-2007-5491 (file permissions issue) - apparently patched by the vendor at 
the same time as my issues were resolved and discovered by Robert Buchholz of 
Gentoo whilst auditing the differences between the patched and unpatched 
versions (3.3.8 vs 3.3.9)

It is intended that CVE-2007-5492 will be updated to reference both code 
execution flaws I reported.  All other issues in the advisory have been 
patched but no CVEs have yet been requested or assigned to the best of my 
knowledge.

Tim
-- 
Tim Brown
 
 

--Boundary-00=_hu7FHBLIZSCENnT
Content-Type: text/x-diff;
  charset="us-ascii";
  name="fixedvulnerability.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename="fixedvulnerability.patch"

Index: command.php
==================================================================--- command.php	(revision 412)
+++ command.php	(working copy)
@@ -94,8 +94,15 @@
     {
         if (!$this->um->isAuthorized($this->command,
             in_array($this->command, array('Log In', 'Log Out', 'Sign Up')),
-            SB_reqVal('command_gid'), SB_reqVal('nid_acl'), SB_reqVal('lid_acl')))
+            SB_reqValInt('command_gid'), SB_reqValInt('nid_acl'), SB_reqValInt('lid_acl')))
         {
+            $bld = 'build' . $this->shortName();
+            $cmd = 'command' . $this->shortName();
+
+            if (!method_exists($this,$bld) && !method_exists($this,$cmd))
+            {
+                $this->command = 'Unknown command!';
+            }
             $this->um->accessDenied();
             return;
         }
@@ -849,6 +856,7 @@
             // be otherwise lost. Needed to go back.
             if ($disabled && $params['type'] == 'text')
             {
+                $params['value'] = str_replace('"',"'",$params['value']);
 ?>
     
 
     
 um->isAuthorized($name,false,null,SB_reqVal('nid_acl'),SB_reqVal('lid_acl'))) continue;
+                if (!$this->um->isAuthorized($name,false,null,SB_reqValInt('nid_acl'),SB_reqValInt('lid_acl'))) continue;
 
                 if ($params['type'] == 'button')
                 {
@@ -1664,7 +1673,7 @@
 
     function buildDeleteTree()
     {
-        $node = $this->tree->getNode(SB_reqVal('nid_acl',true));
+        $node = $this->tree->getNode(SB_reqValInt('nid_acl',true));
         if (!$node) return null;
 
         $fields['Folder Name'] = array('name'=>'name','value'=>$node->name, 'disabled'=>null);
@@ -1677,10 +1686,10 @@
 
     function commandDeleteTree()
     {
-        $this->tree->removeNode(SB_reqVal('nid_acl'), false);
+        $this->tree->removeNode(SB_reqValInt('nid_acl'), false);
         if ($this->um->getParam('user','use_trash'))
         {
-            $this->tree->purgeNode(SB_reqVal('nid_acl'));
+            $this->tree->purgeNode(SB_reqValInt('nid_acl'));
         }
         SB_unsetVal('nid_acl');
         $this->forwardCommand('Maintain Trees');
@@ -1834,7 +1843,8 @@
             return;
         }
 
-        if (SB_reqChk('forward'))
+        // This should handle login from translator.php, we should avoid external redirect
+        if (SB_reqChk('forward') && strpos(SB_reqVal('forward'),'/') === false)
         {
             header('Location: '.SB_reqVal('forward'));
             exit;
@@ -2681,14 +2691,14 @@
             return null;
         }
 
-        if (SB_reqVal('uid') == SB_ADMIN)
+        $uid = intval(SB_reqVal('uid'));
+
+        if ($uid == SB_ADMIN)
         {
             $this->error('Cannot modify administrator!');
             return null;
         }
 
-        $uid = SB_reqVal('uid');
-
         $fields = array();
         $user = $this->um->getUser($uid);
         $fields['Username'] = array('name'=>'email', 'value'=>$user['username'], 'disabled' => null);
@@ -3960,7 +3970,7 @@
     function buildAddFolder()
     {
         $fields = array();
-        $node = $this->tree->getNode(SB_reqVal('nid_acl',true));
+        $node = $this->tree->getNode(SB_reqValInt('nid_acl',true));
         if (!$node) return null;
 
         if ($this->command == 'Add Folder')
@@ -4020,7 +4030,7 @@
 
     function commandAddFolder()
     {
-        $nid = $this->tree->addNode(SB_reqVal('nid_acl'),SB_reqVal('name'),
+        $nid = $this->tree->addNode(SB_reqValInt('nid_acl'),SB_reqVal('name'),
             SB_reqVal('comment'), SB_reqVal('sort_mode'));
 
         if ($this->um->pmode && !$this->hasErrors())
@@ -4037,7 +4047,7 @@
         $this->skipBuild = true;
         $this->reload = !$this->um->getParam('user','extern_commander');
         $this->close = $this->um->getParam('user','auto_close');
-        $this->um->hiddenFolders[SB_reqVal('nid_acl')] = 1;
+        $this->um->hiddenFolders[SB_reqValInt('nid_acl')] = 1;
         $this->um->setParam('user','hidden_folders', implode(':',array_keys($this->um->hiddenFolders)));
         $this->um->saveUserParams();
     }
@@ -4048,7 +4058,7 @@
         $this->reload = !$this->um->getParam('user','extern_commander');
         $this->close = $this->um->getParam('user','auto_close');
 
-        $parent = $this->tree->getNode(SB_reqVal('nid_acl'));
+        $parent = $this->tree->getNode(SB_reqValInt('nid_acl'));
 
         $this->tree->loadNodes($parent, false, 'select', true);
 
@@ -4073,7 +4083,7 @@
 
     function buildFolderProperties()
     {
-        $node = $this->tree->getNode(SB_reqVal('nid_acl', true));
+        $node = $this->tree->getNode( intval(SB_reqValInt('nid_acl', true)) );
 
         $fields = $this->buildAddFolder();
 
@@ -4100,13 +4110,13 @@
 
     function commandFolderProperties()
     {
-        $node = $this->tree->getNode(SB_reqVal('nid_acl', true));
+        $node = $this->tree->getNode(SB_reqValInt('nid_acl', true));
         if ($node->id_parent && !$node->parentHasRight('update'))
         {
             return;
         }
 
-        $nid = SB_reqVal('nid_acl');
+        $nid = SB_reqValInt('nid_acl');
 
         $columns = array
         (
@@ -4131,7 +4141,7 @@
 
     function buildCustomOrder()
     {
-        $node = $this->tree->getNode(SB_reqVal('nid_acl', true));
+        $node = $this->tree->getNode(SB_reqValInt('nid_acl', true));
         $this->tree->loadNodes($node);
 
         $fields['-raw1-'] = "";
@@ -4155,7 +4165,7 @@
 
     function commandCustomOrder()
     {
-        $node = $this->tree->getNode(SB_reqVal('nid_acl', true));
+        $node = $this->tree->getNode(SB_reqValInt('nid_acl', true));
         $this->tree->loadNodes($node);
 
         $order = array();
@@ -4196,7 +4206,7 @@
         $fields['Delete Content Only'] = array('name'=>'content','type'=>'checkbox',
             'title'=>SB_P('command::tooltip_delete_content'));
 
-        $node = $this->tree->getNode(SB_reqVal('nid_acl', true));
+        $node = $this->tree->getNode(SB_reqValInt('nid_acl', true));
 
         if ($this->_deleteContentOnly($node))
         {
@@ -4209,14 +4219,14 @@
 
     function commandDeleteFolder()
     {
-        $node = $this->tree->getNode(SB_reqVal('nid_acl', true));
+        $node = $this->tree->getNode(SB_reqValInt('nid_acl', true));
         $deleteContentOnly = SB_reqVal('content') || $this->_deleteContentOnly($node);
 
-        $this->tree->removeNode(SB_reqVal('nid_acl'), $deleteContentOnly);
+        $this->tree->removeNode(SB_reqValInt('nid_acl'), $deleteContentOnly);
 
         if (!$this->um->getParam('user','use_trash') && $node->hasRight('purge'))
         {
-            $this->tree->purgeNode(SB_reqVal('nid_acl'));
+            $this->tree->purgeNode(SB_reqValInt('nid_acl'));
         }
     }
 
@@ -4229,7 +4239,7 @@
 
     function commandPurgeFolder()
     {
-        $this->tree->purgeNode(SB_reqVal('nid_acl'));
+        $this->tree->purgeNode(SB_reqValInt('nid_acl'));
     }
 
 /******************************************************************************/
@@ -4241,7 +4251,7 @@
 
     function commandUndelete()
     {
-        $this->tree->undeleteNode(SB_reqVal('nid_acl'));
+        $this->tree->undeleteNode(SB_reqValInt('nid_acl'));
     }
 
 /******************************************************************************/
@@ -4261,7 +4271,7 @@
         $sourceId   = SB_reqVal('sid',true);
         $sourceIsNode = SB_reqVal('stype',true);
         $sourceObj  = null;
-        $targetID = SB_reqVal('nid_acl',true);
+        $targetID = SB_reqValInt('nid_acl',true);
         $targetNode = $this->tree->getNode($targetID);
         $sourceNodeId = $sourceId;
 
@@ -4337,7 +4347,7 @@
 
     function commandPaste()
     {
-        $targetID = SB_reqVal('nid_acl');
+        $targetID = SB_reqValInt('nid_acl');
         $sourceId   = SB_reqVal('sid',true);
         $sourceIsNode = SB_reqVal('stype',true);
         $move = SB_reqVal('mode',true)=='Move';
@@ -4401,10 +4411,10 @@
     function buildEmailLink()
     {
         $fields = array();
-        $link = $this->tree->getLink(SB_reqVal('lid_acl'));
+        $link = $this->tree->getLink(SB_reqValInt('lid_acl'));
         if (!$link) return null;
 
-        $fields['--hidden1--'] = array('name'=>'lid_acl', 'value'=> SB_reqVal('lid_acl'));
+        $fields['--hidden1--'] = array('name'=>'lid_acl', 'value'=> SB_reqValInt('lid_acl'));
 
         if ($this->um->canUseMail())
         {
@@ -4433,7 +4443,7 @@
             return;
         }
 
-        $link = $this->tree->getLink(SB_reqVal('lid_acl'));
+        $link = $this->tree->getLink(SB_reqValInt('lid_acl'));
         if (!$link) return null;
 
         $subject = SB_T('SiteBar: Web site') . ' ' . $link->name;
@@ -4520,7 +4530,7 @@
 
         if (SB_reqChk('nid_acl') && SB_reqVal('bookmarklet')!=1)
         {
-            $node = $this->tree->getNode(SB_reqVal('nid_acl'));
+            $node = $this->tree->getNode(SB_reqValInt('nid_acl'));
             $fields['-hidden0-'] = array('name'=>'nid_acl','value'=>$node->id);
             $fields['Parent Folder'] = array('name'=>'parent',
                 'value'=>$node->name,'disabled'=>null);
@@ -4604,7 +4614,7 @@
 
     function commandAddLink()
     {
-        $nid = SB_reqVal('nid_acl',true);
+        $nid = SB_reqValInt('nid_acl',true);
         $node = $this->tree->getNode($nid);
         if (!$node) return;
 
@@ -4639,7 +4649,7 @@
             if (!$page->isDead && $page->errorCode['FAVURL']info['FAVURL'];
-                $favurl   = 'favicon.php?' . md5($favicon) . '=' . SB_reqVal('lid_acl');
+                $favurl   = 'favicon.php?' . md5($favicon) . '=' . SB_reqValInt('lid_acl');
                 $this->message = SB_T('Favicon  found at url %s.', array($favurl, $url));
             }
             else
@@ -4675,7 +4685,7 @@
 
     function commandMarkasDefault()
     {
-        $this->um->setParam('user','default_folder',SB_reqVal('nid_acl'));
+        $this->um->setParam('user','default_folder',SB_reqValInt('nid_acl'));
         $this->um->saveUserParams();
         exit;
     }
@@ -4712,7 +4722,7 @@
 
         if ($this->command!='Add Link')
         {
-            $link = $this->tree->getLink(SB_reqVal('lid_acl'));
+            $link = $this->tree->getLink(SB_reqValInt('lid_acl'));
             if (!$link) return null;
         }
         else
@@ -4805,7 +4815,7 @@
                         }
                         else
                         {
-                            $fields['-raw2-'] = $this->_buildFavicon(SB_reqVal('lid_acl'), $link->favicon);
+                            $fields['-raw2-'] = $this->_buildFavicon(SB_reqValInt('lid_acl'), $link->favicon);
                         }
                     }
                 }
@@ -4910,7 +4920,7 @@
     {
         if (SB_reqVal('private'))
         {
-            $link = $this->tree->getLink(SB_reqVal('lid_acl'));
+            $link = $this->tree->getLink(SB_reqValInt('lid_acl'));
             if (!$link) return;
             if (!$this->tree->inMyTree($link->id_parent))
             {
@@ -4941,7 +4951,7 @@
             else
             {
                 // Delete old URL favicon from cache on update to allow new version
-                $fc->purge(SB_reqVal('lid_acl'));
+                $fc->purge(SB_reqValInt('lid_acl'));
             }
         }
 
@@ -4962,13 +4972,13 @@
             $update['is_dead'] = 0;
         }
 
-        $this->tree->updateLink(SB_reqVal('lid_acl', true), $update);
+        $this->tree->updateLink(SB_reqValInt('lid_acl', true), $update);
     }
 
     function buildExportDescription()
     {
         $fields['Decode Using'] = array('type'=>'callback', 'function'=>'_buildDecodeUsing');
-        $fields['-hidden1-'] = array('name'=>'lid_acl','value'=>SB_reqVal('lid_acl'));
+        $fields['-hidden1-'] = array('name'=>'lid_acl','value'=>SB_reqValInt('lid_acl'));
 
         return $fields;
     }
@@ -4984,7 +4994,7 @@
 
     function commandExportDescription()
     {
-        $link = $this->tree->getLink(SB_reqVal('lid_acl'));
+        $link = $this->tree->getLink(SB_reqValInt('lid_acl'));
         if (!strlen($link->comment))
         {
             $this->error('Cannot export empty description!');
@@ -5019,7 +5029,7 @@
     {
         $fields['Description File'] = array('type'=>'file','name'=>'file');
         $fields['Encode Using'] = array('type'=>'callback', 'function'=>'_buildEncodeUsing');
-        $fields['-hidden1-'] = array('name'=>'lid_acl','value'=>SB_reqVal('lid_acl'));
+        $fields['-hidden1-'] = array('name'=>'lid_acl','value'=>SB_reqValInt('lid_acl'));
         return $fields;
     }
 
@@ -5039,7 +5049,7 @@
             return;
         }
         $filename = $_FILES['file']['tmp_name'];
-        $link = $this->tree->getLink(SB_reqVal('lid_acl'));
+        $link = $this->tree->getLink(SB_reqValInt('lid_acl'));
 
         if ($this->hasErrors())
         {
@@ -5109,7 +5119,7 @@
 
     function commandDeleteLink()
     {
-        $link = $this->tree->getLink(SB_reqVal('lid_acl'));
+        $link = $this->tree->getLink(SB_reqValInt('lid_acl'));
 
         if (!$link)
         {
@@ -5135,7 +5145,7 @@
     function buildSecurity()
     {
         $fields = array();
-        $node = $this->tree->getNode(SB_reqVal('nid_acl',true));
+        $node = $this->tree->getNode(SB_reqValInt('nid_acl',true));
 
         $fields['Folder Name'] = array('name'=>'name','value'=>$node->name,'disabled'=>null);
         $fields['Security'] = array('type'=>'callback',
@@ -5263,7 +5273,7 @@
     {
         $groups = $this->um->getGroups();
         $myGroups = $this->um->getUserGroups();
-        $node = $this->tree->getNode(SB_reqVal('nid_acl',true));
+        $node = $this->tree->getNode(SB_reqValInt('nid_acl',true));
         $sameACL = true;
         $updated = 0;
 
@@ -5335,7 +5345,7 @@
     function buildValidateLinks()
     {
         $fields = array();
-        $node = $this->tree->getNode(SB_reqVal('nid_acl',true));
+        $node = $this->tree->getNode(SB_reqValInt('nid_acl',true));
         if (!$node) return null;
 
         $fields['Folder Name'] = array('name'=>'name','maxlength'=>255,
@@ -5370,7 +5380,7 @@
     function buildValidation()
     {
         $fields = array();
-        $node = $this->tree->getNode(SB_reqVal('nid_acl',true));
+        $node = $this->tree->getNode(SB_reqValInt('nid_acl',true));
         if (!$node) return null;
 
         require_once('./inc/validator.inc.php');
@@ -5415,7 +5425,7 @@
     function buildImportBookmarks()
     {
         $fields = array();
-        $node = $this->tree->getNode(SB_reqVal('nid_acl',true));
+        $node = $this->tree->getNode(SB_reqValInt('nid_acl',true));
 
         $loaders['auto'] = array('', true);
         $dirName = './inc/loaders';
@@ -5535,7 +5545,7 @@
             'Imported %s link(s) into %s folder(s) from the bookmark file.',
             array($bm->importedLinks, $bm->importedFolders));
 
-        $this->tree->importTree(SB_reqVal('nid_acl'), $bm->root, SB_reqChk('rename'));
+        $this->tree->importTree(SB_reqValInt('nid_acl'), $bm->root, SB_reqChk('rename'));
     }
 
     function optionalExportBookmarks()
@@ -5623,7 +5633,7 @@
 
         if (!SB_reqChk('doall'))
         {
-            $fields['-hidden1-'] = array('name'=>'nid_acl','value'=>SB_reqVal('nid_acl'));
+            $fields['-hidden1-'] = array('name'=>'nid_acl','value'=>SB_reqValInt('nid_acl'));
         }
         else
         {
@@ -5681,9 +5691,9 @@
             }
         }
 
-        if (SB_reqChk('nid_acl') && SB_reqVal('nid_acl')>0)
+        if (SB_reqChk('nid_acl') && SB_reqValInt('nid_acl')>0)
         {
-            $params[] = 'root=' . SB_reqVal('nid_acl');
+            $params[] = 'root=' . SB_reqValInt('nid_acl');
         }
 
         if (count($params))
@@ -5718,7 +5728,7 @@
 
         if (!SB_reqChk('doall'))
         {
-            $fields['-hidden1-'] = array('name'=>'nid_acl','value'=>SB_reqVal('nid_acl'));
+            $fields['-hidden1-'] = array('name'=>'nid_acl','value'=>SB_reqValInt('nid_acl'));
         }
         else
         {
Index: google.php
==================================================================--- google.php	(revision 0)
+++ google.php	(revision 0)
@@ -0,0 +1,67 @@
+ * 
+ *                                                                            *
+ *  This program is free software; you can redistribute it and/or modify      *
+ *  it under the terms of the GNU General Public License as published by      *
+ *  the Free Software Foundation; either version 2 of the License, or         *
+ *  (at your option) any later version.                                       *
+ *                                                                            *
+ *  This program is distributed in the hope that it will be useful,           *
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of            *
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the             *
+ *  GNU General Public License for more details.                              *
+ *                                                                            *
+ *  You should have received a copy of the GNU General Public License         *
+ *  along with this program; if not, write to the Free Software               *
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA *
+ ******************************************************************************/
+
+header("Content-type: text/xml");
+echo ''."\n";
+?>
+
+  title_url="http://www.sitebar.org/" 
+    category="communication"
+    category2="tools"
+   />
+  
+  
+