Re: FWD: PhotoPost vBGallery Important Security Bulletin

[trains <trains () doctorunix com>]

Quoting "ad () heapoverflow com" <ad () heapoverflow com>:


> http://www.photopost.com/forum/showthread.php?t=134910
> http://www.photopost.com/forum/showthread.php?p=1213648
>
> It's unclear what type of bug is it about, they are refering to an
> apache bug but since all hacks used to access the database it could be a
> SQL injection. This is critical bug.

This is sort of clever, but obvious in hindsight.  If a web site has  
an upload directory that is also readable, it will be vulnerable.   
Normal sysadmin configurations can prevent this exposure.

Upload directories should not be directly viewable.  That was the  
basis for numerous exploits of frontpage systems back in the day.  A  
script should validate the uploaded file and separately move it to a  
viewable directory.

The reason this is an apache bug is because the default install uses  
an insecure setting for php scripts (perl also).

The "AddType" statement for php is normally system-wide, which means  
the web server will execute php scripts that may be found in the  
upload directory.  This can be fixed multiple ways:
    Move the php AddType statement into a <directory> stanza, or
    Set directory options for directories where we would not expect to  
execute things or use a "AddType" statement in the images directory,  
like:
     <Directory /www/htdocs/images>
       Options +IncludesNoExec -ExecCGI
       AddType text/html .php
       <Files ~ "\.php">
          Order allow,deny
          Deny from all
       </Files>
     </Directory>

that should be redundant enough.

tr

-------------------------------------------------
Email solutions, MS Exchange alternatives and extrication,
security services, systems integration.
Contact:    services () doctorunix com


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/