rrdbrowse-advisory-03-2007.txt

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
I - TITLE  
  
Security advisory: Arbitrary file disclosure vulnerability in  
rrdbrowse  
  
II - SUMMARY  
  
Description: Arbitrary file disclosure vulnerability in  
rrdbrowse <= 1.6  
  
Author: Sebastian Wolfgarten (sebastian at wolfgarten dot com),  
http://www.devtarget.org  
  
Date: March 4th, 2007  
  
Severity: Medium  
  
References: http://www.devtarget.org/rrdbrowse-advisory-03-2007.txt  
  
III - OVERVIEW  
  
Quote from rrdbrowse.org: "RRDBrowse is a poller daemon, templater and  
webinterface for RRDTool. It has a threaded daemon which periodically  
runs from cron. It works with small .nfo files which hold router  
information and optionally connection details, colors, min max,  
bandwidth settings, etc, etc. RRDBrowse uses a small caching mechanism  
to store interface names. It's much MRTG like in it's current state".  
More information about the product can be found online at  
http://www.rrdbrowse.org.  
  
IV - DETAILS  
  
Due to inproper input validation, the CGI application "rrdbrowse"  
(versions <=1.6) is vulnerable to an arbitrary file disclosure  
vulnerability. It allows an unauthenticated remote attacker to read any  
file on the remote system if the user the webserver is running as has  
permissions to do so. Thus an attacker is able to gain access  
potentially sensitive information.  
  
V - EXPLOIT CODE  
  
The vulnerability is trivial to exploit and only requires specifying an  
URL with a relative file path on the remote system such as  
  
http://$target/cgi-bin/rb.cgi?mode=page&file=../../../../../../../../etc/passwd  
  
As the input to the "file" parameter is not validated in any way  
accessing this URL will expose the contents of /etc/passwd to a remote  
attacker (interestingly except the first line).  
  
VI - WORKAROUND/FIX  
  
To address this problem, the author of rrdbrowse (Tommy van Leeuwen) has  
released an updated CVS version (1.7) of the software which is available  
at http://www.rrdbrowse.org. Hence all users of rrdbrowse are asked to  
test and install this version as soon as possible.  
  
VII - DISCLOSURE TIMELINE  
  
06. February 2007 - Notified vendor  
14. Feburary 2007 - Patch/new version released  
04. March 2007 - Public disclosure  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.5 (MingW32)  
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org  
  
iD8DBQFF6x+Gd8QFWG1Rza8RAl6FAKCw6la8aVEeWRjqQrodHDUDAl3vtgCgwmam  
X8HoWAJAhG3FlWeOebHRCTY=  
=ifKG  
-----END PGP SIGNATURE-----  
`