CSSoft-EZTRansI-Eng.txt

2003-07-09T00:00:00
ID PACKETSTORM:31335
Type packetstorm
Reporter STG Security
Modified 2003-07-09T00:00:00

Description

                                        
                                            `STG Security Advisory: [SSA-20030701-03] ChangshinSoft ezTrans Server File  
Download Vulnerability  
  
Revision 1.1  
Date Published: 2003-07-08 (KST)  
Last Update: 2003-07-08  
Disclosed by SSR Team (advisory@stgsecurity.com)  
  
  
Synopsis  
========  
ezTrans Server, used by famous portal sites in Korea, is a real-time  
Korean-to-Japanese and Japanese-to-Korean translator made by ChangshinSoft.  
For inappropriate input validation in a file download module of ezTrans  
Server, an attacker can download files accessible to web server privilege.  
  
Vulnerability Class  
===================  
Implementation Error: Inappropriate Input Validation  
  
Details  
=======  
For inappropriate input validation in a file download module of ezTrans  
Server, an attacker can download files accessible to web server privilege.  
  
Proof of Concept:  
http://[victim  
site]/question/crm/download.php?filename=../../../../../../../../../../../..  
/etc/passwd  
  
http://[victim  
site]/download.php?filename=../../../../../../../../../../../../../etc/passw  
d  
  
Exploiting this vulnerability, an attacker can download files which  
include critical information and damage a portal site with another  
vulnerable web application.  
  
Impact  
======  
An attacker can read critical information on the victim site.  
Using this vulnerability and exploiting another vulnerable web applications,  
a malicious attacker can dispossess a web server.  
  
Workaround  
==========  
It's very difficult to program secure web applications in PHP. Nonetheless  
you can minimize security problems by setting php.ini up appropriately.  
  
To minimize the effects of this vulnerability, we recommend following  
workarounds.  
  
1. Turn register_globals option in php.ini OFF. For detailed information,  
refer to below sites.  
2. Delete the vulnerable download.php and use static link to a file  
to download inside your HTML source.  
  
References  
Study in Scarlet - http://www.securereality.com.au/studyinscarlet.txt  
Securing PHP: Step-by-step - http://www.securityfocus.com/infocus/1706  
  
Affected Products  
================  
ezTrans Server  
  
Vendor Status: FIXED  
===================  
2003-06-24 CSSoft notified.  
2003-06-26 Second attempt at vendor and system administrator contact.  
2003-07-02 Third attempt at vendor contact.  
2003-07-04 Forth attempt at vendor contact.  
2003-07-04 Vendor replied.  
2003-07-04 Last attempt at vendor contact.  
2003-07-04 Vendor fixed.  
2003-07-08 Public disclosure  
  
  
Credits  
======  
Jeremy Bae at STG Security SSR Team  
  
About STG Security  
=================  
STG Security Inc. is a affiliated company of STG Group which has its head  
office in the States founded in march 2000. Its core business area is  
professional penetration testing, security code review and BS7799 consulting  
services.  
  
http://www.stgsecurity.com/  
  
Phone +82-2-6333-4500  
FAX +82-2-6333-4545  
  
`