Re: Squirrelmail local file inclusion

[Paul Schmehl <pauls () utdallas edu>]

--On June 1, 2006 12:50:15 AM +0000 brokejunker () yahoo com wrote:

> Squirrelmail local file inclusion bug in functions/plugin.php .
> Tested on the latest 1.4.x version.
> No authentication needed.
>
> if (isset($plugins) && is_array($plugins)) {
>     foreach ($plugins as $name) {
>         use_plugin($name);
>     }
> ...
> function use_plugin ($name) {
>     if (file_exists(SM_PATH . "plugins/$name/setup.php")) {
>         include_once(SM_PATH . "plugins/$name/setup.php");
>         $function = "squirrelmail_plugin_init_$name";
>         if (function_exists($function)) {
>             $function();
>         }
>     }
> }
> ....
>
> If register_globals is on we can control the $name variable.
This is the second "bug" I've seen in the past week that requires 
register_globals to be on.  Yet register_globals has been off by default 
for the past four years.  <http://us2.php.net/ChangeLog-4.php#4.2.0>

The developers of PHP specifically address its use and warn against it 
unless you know what you're doing.  <http://us2.php.net/register_globals>

Squirrelmail even warns specifically against using register_globals = on 
and checks for it when installing.

grep register_globals /usr/local/share/doc/squirrelmail/*
/usr/local/share/doc/squirrelmail/ChangeLog:  - Added PHP register_globals 
check to configuration test utility.
/usr/local/share/doc/squirrelmail/ChangeLog:  - Fixed use of 
squirrelmail_language cookie with PHP register_globals =
/usr/local/share/doc/squirrelmail/ChangeLog:  - Prefs caching didn't work 
properly with register_globals off (#995102).
/usr/local/share/doc/squirrelmail/ChangeLog:    by register_globals = off.
/usr/local/share/doc/squirrelmail/ChangeLog:  - This release is compatible 
with installations that have register_globals set to off.
/usr/local/share/doc/squirrelmail/INSTALL:  It is highly advised to NOT 
turn on register_globals, as this can lead
/usr/local/share/doc/squirrelmail/INSTALL:  to security holes. If you must 
use register_globals for some applications,
/usr/local/share/doc/squirrelmail/security.txt:- PHP configuration. It's 
very important to turn register_globals OFF.
/usr/local/share/doc/squirrelmail/security.txt:  could only be exploited 
when register_globals was set to on. If you
/usr/local/share/doc/squirrelmail/security.txt:  need register_globals for 
other web applications, turn it on specifically

Yet know we're getting "security advisories" warning, hey, if you change 
the defaults and ignore all the warnings, you too can write insecure code!

Is human stupidity a software bug?

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/

Attachment: _bin
Description: