opt님이 보안 취약점을 열심히 올리시네요.
수고가 많으십니다. santy 웜이 아주 발작을 하는 시점에 무덤덤하네요. 그누보드는 근 한달 사이에 2번째인듯하네요
이젠 보드 사이를 해매고 있는데 이것도 spyki에 바로 올라가겠는데요.
ps. 이젠 무슨 보드를 써야할지 휴우
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
STG Security Advisory: [SSA-20041224-21] File extensions restriction bypass
vulnerability in GNUBoard.
Revision 1.0
Date Published: 2004-12-24 (KST)
Last Update: 2005-01-33
Disclosed by SSR Team (advisory at stgsecurity.com)
Summary
========
GNUBoard is one of widely used web BBS applications in Korea. However, an
input validation flaw can cause malicious attackers to run arbitrary
commands with the privilege of the HTTPD process, which is typically run as
the nobody user.
Vulnerability Class
===================
Implementation Error: Input validation flaw
Impact
======
High : arbitrary command execution.
Affected Products
================
GNUBoard 3.40 and prior
Vendor Status: NOT FIXED
========================
2004-12-09 Vulnerability found
2004-12-09 Vendor contacted and confirmed.
2005-01-03 Official release.
Details
=======
Implementation of check every file extension of upload files is
case-sensitive. Bypassing this mechanism, malicious attackers can upload
arbitrary script files (php, pl, cgi, etc) to a web server.
gbupdate.php (107 line)
- ----
// 실행가능한 스크립트 확장자
$source = array ("/\.php/", "/\.htm/", "/\.cgi/", "/\.pl/");
$target = array (".phpx", ".htmx", ".cgix", ".plx");
- ----
gbupdate.php (142 line)
- ----
// php_x 와 같은 방법으로 스크립트 실행을 하지 못하게 하였으나 abc.php._x
는 실행되는 버그가 있음
$filename = preg_replace($source, $target, $filename);
// 접두사를 붙인 파일명
$upload[$i] = $prefix . $filename;
$dest_file = "./data/file/$bo_table/$upload[$i]";
- ----
malicious attackers can upload [attack].PHP.rar, [attack].pHp.rar, etc.
Solution
=========
modify 108th line of gbupdate.php as following
$source = array ("/\.php/i", "/\.htm/i", "/\.cgi/i", "/\.pl/i");
Vendor URL
==========
http://www.sir.co.kr/
Credits
======
Jeremy Bae at STG Security
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0
iQA/AwUBQdjxDD9dVHd/hpsuEQIfQgCdH1I3gYRYQhM49hOOEKg35puXscUAoK07
zKwL5QKjuY2Nb2yzKAtFwDhJ
=o+Ui
-----END PGP SIGNATURE-----