oss-sec mailing list archives
Re: CVE request: PLOGGER 1.0RC1 multiple vulnerabilities
From: Damien Cauquil <d.cauquil () sysdream com>
Date: Thu, 27 Feb 2014 14:58:21 +0100
I think there is a mistake from our part about the "race condition". After a quick review, there is no "race condition" but simply some requirements about the zip file and a cleaning step that should not be be performed by the application in order to keep all the files on the server. Here are the steps to follow to exploit this vulnerability: 1. create a zip file containing at least one non-empty image file with a valid extension (such as .jpg) 2. upload the file through the upload form, the application will unzip it in a standard location and will tell the user about the image files found. If we go on at this step, all the extracted images will be processed and all the extracted files then deleted. So we just stop right here, and 3. access the php file extracted by the application I don't know if I'm really clear about what happens, Le 27/02/2014 14:29, cve-assign () mitre org a écrit :
The zip file must at least contains a non-empty image file with a name including a valid extension, and of course the exploit php file.Maybe your reply means that if this "must at least" requirement is not satisfied, then a race condition occurs. But what is the race condition: what action is in a race against what other action?
-- Damien Cauquil Directeur Recherche & Développement CHFI | CEH | ECSA | CEI Sysdream 108 avenue Gabriel Péri 93400 Saint Ouen Tel: +33 (0) 1 78 76 58 21 www.sysdream.com
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- CVE request: PLOGGER 1.0RC1 multiple vulnerabilities Damien Cauquil (Feb 26)
- Re: CVE request: PLOGGER 1.0RC1 multiple vulnerabilities cve-assign (Feb 27)
- Re: CVE request: PLOGGER 1.0RC1 multiple vulnerabilities Damien Cauquil (Feb 27)
- Re: CVE request: PLOGGER 1.0RC1 multiple vulnerabilities cve-assign (Feb 27)
- Re: CVE request: PLOGGER 1.0RC1 multiple vulnerabilities Damien Cauquil (Feb 27)
- Re: CVE request: PLOGGER 1.0RC1 multiple vulnerabilities Damien Cauquil (Feb 27)
- Re: CVE request: PLOGGER 1.0RC1 multiple vulnerabilities cve-assign (Feb 27)