Bugtraq mailing list archives
Re: Digital Armaments Security Advisory 02.14.2006: Gallery web-based photo gallery remote file execution
From: Bharat Mediratta <bharat () menalto com>
Date: Thu, 16 Feb 2006 10:49:51 -0800
Thanks to Digital Armaments for the notification and allowing us to rev up a patch before posting the flaw. Corrections to the advisory inline below. info () digitalarmaments com wrote: ...
II. Problem Description Every user with privileges (who can modify appareance of one Gallery's album) can include any file located on the server. This vulnerability can be found in util.php. It allows to an attacker to read files on the remote system or execute arbitrary PHP code with apache privileges if the attacker can upload files.
A user with active admin privileges must be tricked into clicking on a carefully crafted url in order to set up this attack. It can only be used to execute PHP files on the local system, so the attacker must contrive some other way to get the PHP file onto the server before it can be used, therefore this advisory is not a "remote file execution" as mentioned in the subject line.
V. Solution First notification 12.20.2005.
No first notification was received to our security mailing list. For security notifications, please notify security () gallery menalto com. Thank you.
Second notification 01.14.2006. The vendor answered second notification. A new patched version is available.
The security fix released is available here: http://gallery.menalto.com/gallery_1_5_2_pl2_security_release -Bharat Gallery Project Lead
Current thread:
- Digital Armaments Security Advisory 02.14.2006: Gallery web-based photo gallery remote file execution info (Feb 15)
- Re: Digital Armaments Security Advisory 02.14.2006: Gallery web-based photo gallery remote file execution Bharat Mediratta (Feb 17)