제로데이취약점 XAMPP 1.8.1 (lang.php, WriteIntoLocalDisk method) - Local Write Access Vulnerability

2013.10.17 00:10

가을의 곰을... 조회 수:1260

XAMPP 1.8.1 (lang.php, WriteIntoLocalDisk method) - Local Write Access Vulnerability

 

=============================================
INTERNET SECURITY AUDITORS ALERT 2013-007
- Original release date: March 14th, 2013
- Last revised:  March 19th, 2013
- Discovered by: Manuel García Cárdenas
- Severity: 6,8/10 (CVSS Base Score)
- CVE-ID: CVE-2013-2586
=============================================
 
I. VULNERABILITY
-------------------------
XAMPP 1.8.1 Local Write Access Vulnerability
 
II. BACKGROUND
-------------------------
XAMPP is a free and open source cross-platform web server solution stack
package, consisting mainly of the Apache HTTP Server, MySQL database, and
 
interpreters for scripts written in the PHP and Perl programming languages.
 
III. DESCRIPTION
-------------------------
It has been detected than an unprivileged user can write in the local
disk and the local file "lang.tmp" can be modified in the remote machine.
 
The injection is done through the page "/xampp/lang.php".
 
IV. PROOF OF CONCEPT
-------------------------
Malicious Request
 
http://vulnerablesite.com/xampp/lang.php?WriteIntoLocalDisk
 
And next, if we access to the file:
 
http://vulnerablesite.com/xampp/lang.tmp
 
We can verify that the file was modified.
 
V. BUSINESS IMPACT
-------------------------
An attacker can execute arbitrary HTML or script code in a targeted
user's browser, this can leverage to steal sensitive information as user
credentials,
 
personal data, etc.
 
VI. SYSTEMS AFFECTED
-------------------------
XAMPP 1.8.1
 
VII. SOLUTION
-------------------------
All data received by the application that can be modified by the user
must be validated.
 
VIII. REFERENCES
-------------------------
http://www.apachefriends.org
http://www.isecauditors.com
 
IX. CREDITS
-------------------------
This vulnerability has been discovered
by Manuel García Cárdenas (mgarcia (at) isecauditors (dot) com).
 
X. REVISION HISTORY
------------------------
March           14, 2013: Initial release
September   26, 2013: Final release
 
XI. DISCLOSURE TIMELINE
-------------------------
March            14, 2013: Vulnerability acquired by Internet Security
Auditors (www.isecauditors.com).
March            16, 2013: CVE-ID received.
March            18, 2013: Sent to Development Manager.
August           30, 2013: New version that includes patched code.
September   26, 2013: Sent to lists.
 
 
XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with
no warranties or guarantees of fitness of use or otherwise. Internet
Security
 
Auditors accepts no responsibility for any damage caused by the use or
misuse of this information.
 
XIII. ABOUT
-------------------------
Internet Security Auditors is a Spain based leader in web application
testing, network security, penetration testing, security compliance
implementation and
 
assessing. Our clients include some of the largest companies in areas
such as finance, telecommunications, insurance, ITC, etc. We are vendor
independent
 
provider with a deep expertise since 2001. Our efforts in R&D include
vulnerability research, open security project collaboration and
whitepapers,
 
presentations and security events participation and promotion. For
further information regarding our security services, contact us.
 
XIV. FOLLOW US
-------------------------
You can follow Internet Security Auditors, news and security advisories at:
https://www.facebook.com/ISecAuditors
https://twitter.com/ISecAuditors
http://www.linkedin.com/company/internet-security-auditors
http://www.youtube.com/user/ISecAuditors

 

경축! 아무것도 안하여 에스천사게임즈가 새로운 모습으로 재오픈 하였습니다.
어린이용이며, 설치가 필요없는 브라우저 게임입니다.
https://s1004games.com

 

본 웹사이트는 광고를 포함하고 있습니다.
광고 클릭에서 발생하는 수익금은 모두 웹사이트 서버의 유지 및 관리, 그리고 기술 콘텐츠 향상을 위해 쓰여집니다.
, , 이 게시물을
목록
목록
쓰기
태그
대표 김성준 주소 : 경기 용인 분당수지 U타워 등록번호 : 142-07-27414
통신판매업 신고 : 제2012-용인수지-0185호 출판업 신고 : 수지구청 제 123호 개인정보보호최고책임자 : 김성준 sjkim70@stechstar.com
대표전화 : 010-4589-2193 [fax] 02-6280-1294 COPYRIGHT(C) stechstar.com ALL RIGHTS RESERVED