oss-sec mailing list archives
Re: YingZhi Python Programming Language for iOS ftp .. bug & httpd arbitrary upload
From: cve-assign () mitre org
Date: Fri, 30 Aug 2013 02:46:48 -0400 (EDT)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
I'd like to request a CVE for these vulnerabilities I disclosed back on Sept 27 2012. http://vapid.dhs.org/advisories/python_for_ipad.html YingZhi Python Programming Language for iOS Vendor: XiaoWen Huang, YingZhi Python for iOS. Ver 1.9. OSVDB IDs: 96719 & 96720 Product Websites http://sosilen.blog.163.com http://www.iphoneappstorm.com/iphone-apps/utilities/com.yingzhi.python/yingzhipython.php?id=493505744 YingZhi Python Interpreter is a native python development application for the iPad/iPhone. It is available for iOS 4 and above. The product is packaged with its own httpd and ftpd servers. Enabling the local daemons for development by Touching Computer<->This Machine starts up an httpd server and ftpd server, both daemons are bound to device IP not localhost.
httpd server allows upload of arbitrary files to root WWW directory. Browsing to http://<target_ip>:8080/ presents an index page in which anyone can upload files to the web servers root directory.
Use CVE-2013-5654. Support for anonymous upload is, at least, rare in HTTP servers and this behavior would seem to violate reasonable user expectations. If you have any further information about the specific statements in OSVDB entry 96720, please let us know. For example, have you confirmed that the default configuration of this HTTP server enables a PHP interpreter, such that uploads of .php files are especially dangerous?
ftp server vulnerable to ../ bug The ftp server doesn't sanitize user input and allows remote users to read and possibly write to the devices storage. ftp://192.168.0.24:10000/../../../../../../../private/etc/passwd
Use CVE-2013-5655.
The ftp server doesn't bother authenticating users, any username/password combination will allow you in.
We're not immediately assigning a CVE ID for this authentication behavior because it might be an intentional part of the vendor's design, and might have been reasonable in the vendor's envisioned development environment. If there is any documentation suggesting that this is instead an authentication bypass (e.g., the product allows the user to configure a username/password combination), the assignment can of course be reconsidered. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJSID68AAoJEGvefgSNfHMdbt4IALFMSBoUA/WIybOGhq6wXFV+ hc1S9kiDnKxjtR/IEnSnmjEBkF+iOdYoh2KOM41veWZD5hfoDgE2jgU3CRVHXEC7 OAhievWB9Bx5SZghIyJFjfqAwhLjS/9DmDonDFN8EBIguflaN36e7clr3+/ixzZ5 tzKElNelBcbgjf0WaQqfPpHRB46JJQFQ3AvqRMOyi1YbcG2LJ+uC8bylqvhXYbta g/LqwJ8UaxZ886Hd+V1k/+sYUL9S/VzgGnkQd4QPZJXVsAfFcEELubpnEyO0m3g+ OQaKqLjvhA6YTfe6GuY2LJgh583UUrl8Bv+dUuP4nsiELpcZQDHa6AZjbbFJVSw= =pgG9 -----END PGP SIGNATURE-----
Current thread:
- YingZhi Python Programming Language for iOS ftp .. bug & httpd arbitrary upload Larry W. Cashdollar (Aug 29)
- Re: YingZhi Python Programming Language for iOS ftp .. bug & httpd arbitrary upload cve-assign (Aug 29)
- Re: YingZhi Python Programming Language for iOS ftp .. bug & httpd arbitrary upload Larry W. Cashdollar (Aug 30)
- Re: YingZhi Python Programming Language for iOS ftp .. bug & httpd arbitrary upload Larry W. Cashdollar (Aug 30)
- YingZhi Lua Programming Language for iOS ftp .. bug & httpd arbitrary upload Larry W. Cashdollar (Aug 30)
- Re: YingZhi Python Programming Language for iOS ftp .. bug & httpd arbitrary upload Larry W. Cashdollar (Aug 30)
- Re: YingZhi Python Programming Language for iOS ftp .. bug & httpd arbitrary upload cve-assign (Aug 29)