Bugtraq mailing list archives
STG Security Advisory: [SSA-20041215-17] Vulnerability of uploading files with multiple extensions in JSBoard
From: <advisory () stgsecurity com>
Date: 16 Dec 2004 02:41:41 -0000
STG Security Advisory: [SSA-20041215-17] Vulnerability of uploading files with multiple extensions in JSBoard Revision 1.0 Date Published: 2004-12-15 (KST) Last Update: 2004-12-15 Disclosed by SSR Team (advisory () stgsecurity com) Summary ======== JSBoard is one of widely used web BBS applications in Korea. However, an input validation flaw can cause malicious attackers to run arbitrary commands with the privilege of the HTTPD process, which is typically run as the nobody user. Vulnerability Class =================== Implementation Error: Input validation flaw Impact ====== High : arbitrary command execution. Affected Products ================ JSBoard 2.0.8 and prior. JSBoard 1.3.11 and prior. Vendor Status: FIXED ==================== 2004-12-08 Vulnerability found. 2004-12-08 JSBoard developer notified. 2004-12-09 Update version released. 2004-12-15 Official release. Details ======= JSBoard doesn't implemented in "include/parse.php" to check multiple extensions of uploaded files, e.g. attack.php.hwp, so malicious attackers can upload arbitrary script files (php, pl, cgi, etc) to a web server. This is originated from a feature of Apache MIME module (mod_mime), which regards attack.php.hwp as a normal PHP file and execute the file through mod_php module with the privilege of the HTTPD process. cf. http://httpd.apache.org/docs/mod/mod_mime.html - "Files with Multiple Extensions" : it's a feature, not a bug. Solution ========= JSBoard 2.x branch : Update to 2.0.9 http://kldp.net/frs/download.php/1670/jsboard-2.0.9.tar.gz JSBoard 1.x branch : Update to 1.3.13 http://kldp.net/frs/download.php/1668/jsboard-1.3.13.tar.gz Vendor URL ========== http://kldp.net/projects/jsboard/ Credits ====== Jeremy Bae at STG Security
Current thread:
- STG Security Advisory: [SSA-20041215-17] Vulnerability of uploading files with multiple extensions in JSBoard advisory (Dec 16)