Re: Digital Armaments Security Advisory 02.14.2006: Gallery web-based photo gallery remote file execution

[Bharat Mediratta <bharat () menalto com>]

Thanks to Digital Armaments for the notification and allowing us to rev
up a patch before posting the flaw.  Corrections to the advisory inline
below.

info () digitalarmaments com wrote:
...
> II. Problem Description
>
> Every user with privileges (who can modify appareance of one
> Gallery's album) can include any file located on the server. This
> vulnerability can be found in util.php. It allows to an attacker to
> read files on the remote system or execute arbitrary PHP code with
> apache privileges if the attacker can upload files.

A user with active admin privileges must be tricked into clicking on a
carefully crafted url in order to set up this attack.  It can only be
used to execute PHP files on the local system, so the attacker must
contrive some other way to get the PHP file onto the server before it
can be used, therefore this advisory is not a "remote file execution" as
mentioned in the subject line.

> V. Solution
>
> First notification 12.20.2005. 

No first notification was received to our security mailing list.  For
security notifications, please notify security () gallery menalto com.
Thank you.

> Second notification 01.14.2006.
> The vendor answered second notification. A new patched version is
> available.

The security fix released is available here:
http://gallery.menalto.com/gallery_1_5_2_pl2_security_release

-Bharat
Gallery Project Lead