album.pl Photo Album Software May Let Remote Users Execute Arbitrary Commands
|
|
SecurityTracker Alert ID: 1006653 |
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Apr 28 2003
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 6.1 and prior versions
|
Description: A vulnerability was reported in the 'album.pl' photo album software. A remote user can execute operating system commands on the server.
AresU reported that, if an alternate configuration file is used, a remote user can execute arbitrary commands on the server with the privileges of the web server.
The nature of the flaw was not disclosed.
|
Impact: A remote user may be able to execute arbitrary operating system commands on the target server with the privileges of the web server process.
|
Solution: The vendor has released a fixed version (6.2), available at:
http://perl.bobbitt.ca/album/album62.zip
|
Vendor URL: perl.bobbitt.ca/album (Links to External Site)
|
Cause: Not specified
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: aresu@bosen.net
|
Message History:
None.
|
Source Message Contents
|
Date: Sun, 27 Apr 2003 01:50:29 +0700
From: aresu@bosen.net
Subject: Album.pl Vulnerability - Remote Command Execution
|
AresU Advisory
04/27/2003
Album.pl Vulnerability
Severity : High (CGI Remote Command Execution)
Systems Affected: Album.pl up to v6.1
Vendor URL: http://perl.bobbitt.ca/album
Vuln Type : CGI Remote Command Execution
Status : Vendor contacted, new fixed version available
Author : AresU
Greetz to : Mike B., Bosen, Tioeuy, syzwz, Heltz, eF73, SakitJiwa, nimdA, Br0374l, FreshFirst, Algori
thm
All 1ndonesian Security Team (1st)
http://www.bosen.net/releases/
http://bosen.blogspot.com
Summary
=======
album.pl is a popular web photo album application that allows you to simply drop new photo files into
a directory, and they will automatically
be accessible via the web.
Any user can execute commands with Web Server privileges (normally nobody) when use an alternate conf
iguration file.
Solution
========
Upgrade to a newer album.pl version (at least 6.2)
http://perl.bobbitt.ca/album/album62.zip
Acknowledgments
===============
Vulnerability discovery and advisory by AresU
Vendor Response
===============
Vendor has been contacted and new fixed version is available.
Exploit Code
============
I have refrained from publishing a more functional exploit at this time,
to delay attacks against album.pl installations.
-----------------------------------------------
This mail sent through http://webmail.bosen.net
|
|
