Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web BBS :: Frequently Exploited :: hack7200.htm

phpBB vuln of uploading files with multiple extensions in phpBB Attachment Mod



STG Security Advisory: [SSA-20041215-18] Vulnerability of uploading files with multiple extensions in phpBB Attachment Mod



STG Security Advisory: [SSA-20041215-18] Vulnerability of uploading files

with multiple extensions in phpBB Attachment Mod



Revision 1.1

Date Published: 2004-12-15 (KST)

Last Update: 2004-12-15

Disclosed by SSR Team (advisory@stgsecurity.com) 



Summary

========

phpBB Attachment Mod is file upload module for phpBB. However, an input

validation flaw can cause malicious attackers to run arbitrary commands with

the privilege of the HTTPD process, which is typically run as the nobody

user.



Vulnerability Class

===================

Implementation Error: Input validation flaw



Impact

======

High : arbitrary command execution.



Affected Products

================

Attachment Mod 2.3.10 and prior.



Vendor Status: FIXED

====================

2004-12-08 Vulnerability found.

2004-12-08 Attachment Mod developer notified.

2004-12-13 Update version released.

2004-12-15 Official release.



Details

=======

Attachment Mod doesn't implemented to check multiple extensions of uploaded

files, e.g. attack.php.rar, so malicious attackers can upload arbitrary

script files (php, pl, cgi, etc) to a web server. This is originated from a

feature of Apache MIME module (mod_mime), which regards attack.php.rar as a

normal PHP file and execute the file through mod_php module with the

privilege of the HTTPD process.

cf. http://httpd.apache.org/docs/mod/mod_mime.html - "Files with Multiple

Extensions" : it's a feature, not a bug.



Solution

=========

Update to 2.3.11

http://www.opentools.de/board/viewtopic.php?t=3590 



Vendor URL

==========

http://www.opentools.de/ 



Credits

======

Jeremy Bae at STG Security


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH