SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
SecurityReason
IT News
Search
SecurityAlert Database
About SecurityAlert
ExploitAlert Database
SecurityReason Research
WLB
WLB Database
Send to WLB
About WLB
Services
Security Audit
Schedule
Prices of services
Contact
RSS
SecurityReason IT News
SecurityAlert
World Laboratory of Bugtraq
ExploitAlert
Apache
PHP
Corporate
Contact
About SecurityReason
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com
Home arrow SecurityAlert Database

Arrow  Topic :

Gallery Input Validation Bug in Processing Internal Cache Files Lets Remote Users Traverse the Directory


Arrow  SecurityAlert : 88
Arrow  CVE : CVE-2005-3251
Arrow  SecurityRisk : Medium  Security Risk Medium  (About)
Arrow  Remote Exploit : Yes
Arrow  Local Exploit : No
Arrow  Exploit Available : Yes
Arrow  Credit : Michael Dipper
Arrow  Published : 16.10.2005

Arrow  Affected Software : Gallery 2.0
Gallery 2.0 Beta 3
Gallery 2.0 Beta 2
Gallery 2.0 Beta 1
Gallery 2.0 Alpha 4
Gallery 2.0 Alpha 3
Gallery 2.0 Alpha 2
Gallery 2.0 Alpha 1
CVS HEAD before 2005-10-13




Arrow  Advisory Content :  

Vendor information:

Gallery is an open source web based photo album organizer. The
2.x is a newly released complete rewrite of the application.

Url: http://gallery.menalto.com
Contact: gallery@menalto.com

Vulnerability class:

Input sanitization

Details:

Michael Dipper has discovered an input sanitization issue that
allows users to specially craft a url to access any file on the
server that is accessible by the webserver. The vulnerability
may be used by any visitor to the Gallery, no user login is
required.

Exploit:

The vulnerability may be exploited by accessing a URL like this:

http://example.com/gallery2/main.php
?g2_itemId=/../../../../../../../etc/aliases%00

Internally the Gallery caching code uses this variable to
construct a relative filename to a cache file. Using ../..
elements in the path allow you to escape the Gallery directory
and view files that are not regularly available via the webserver.

Solution:

The Gallery team has released Gallery 2.0.1 which resolves this
security issue by validating the input variable, modifying the
caching code to prevent it from generating paths with '..' in
them, and modifying the choke point on included files to prevent
it from loading files that contain '..' in them.

Download 2.0.1 (including patch files from 2.0) from here:
http://codex.gallery2.org/Gallery2:Download

A big thanks to Michael Dipper for bringing this to our attention
and providing us with lead time to make a patch available before
fully disclosing it.

Vulnerable:
Gallery 2.0
Gallery 2.0 Beta 3
Gallery 2.0 Beta 2
Gallery 2.0 Beta 1
Gallery 2.0 Alpha 4
Gallery 2.0 Alpha 3
Gallery 2.0 Alpha 2
Gallery 2.0 Alpha 1
CVS HEAD before 2005-10-13

Not Vulnerable:
Gallery 1.x
Gallery Remote (all versions)

Credit:
Michael Dipper
http://dipper.info/

History:
20051012 - Initial discovery and reporting
(Michael Dipper, micha-at-dipper.info )
20051013 - Vendor fix released






Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

libc:fts_*() Multiple Denial of Service

Security Risk Medium- 2009-10-02

The fts functions are provided for traversing UNIX file hierarchies...
Apache RSS Apache Alert

» Apache 1.3.41 mod_proxy
   Integer overflow (code
   execution)

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion in work
   directory

» Apache Tomcat 6.0.20 and
   5.5.28 insecure partial
   deploy after failed
   undeploy

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion and/or
   alteration
PHP RSS PHP Alert

» PHP 5.2.12/5.3.1
   session.save_path
   safe_mode and
   open_basedir bypass

» PHP 5.2.12/5.3.1 Multiple
   Vulnerabilities

» PHP 5.2.11 libgd multiple
   vulnerabilities

» PHP 5.2.11 tempnam()
   safe_mode bypass
Copyright © SecurityReason.com. All Rights Reserved.