The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

Beyond Security would like to welcome Tiscali World Online
to our service provider team.
For more info on their service offering IP-Secure, 
please visit http://www.worldonline.co.za/services/work_ip.asp
- - - - - - - - -



  Unauthorized File Access Vulnerability Found in phpMyNewsletter
------------------------------------------------------------------------


SUMMARY

 <http://gregory.kokanosky.free.fr/phpmynewsletter/> phpMyNewsletter is a 
newsletter management script written in PHP. A security hole allowing 
unauthorized access to arbitrary files (for example /etc/passwd) has been 
found in the product. The vulnerability occurs even after the patch by  
<http://www.securiteam.com/unixfocus/6U0011P5QQ.html> phpsecure.org has 
been applied.

DETAILS

Vulnerable versions:
 * phpMyNewsletter version 0.6.11 and prior 
 * phpMyNewsletter version 0.7 (beta)

Immune versions:
 * phpMyNewsletter version 0.6.12 and above

The patch fix was 

---from /include/customize.php -----------------

<?
 $langfile = $l;
 if ((!ereg("..",$l)) AND (file_exists($l))){
  include($l);
 }else{
  echo "Lang File can't be found.";
 }

<snip>

?>
--------------------------------------------------------
This patch caused the code to cease functioning as it should:

ereg ("..", $l) will return always TRUE, therefore !ereg ("..",$l) will 
return FALSE.
This problem occurs because "." is evaluated as a regular expression whose 
value is any single character.
See  <http://www.php.net/manual/en/function.ereg.php> Ereg Function for 
more details.

To fix the problem:


if ( (!ereg("\.\.",$l)) AND (file_exists($l)) ){


Taking the literal value of "." seems to solve this problem, but although 
customize.php?l=../index.html would not work,  customize.php?l=/etc/passwd 
will work (there is no need for directory traversal to access arbitrary 
files).

The Workaround:
<?
 $l = basename($l);                         # Sanitize
 if ( (ereg("^lang-", $l)) AND (file_exists($l)) ){        # valid 
filename?
  include($l);                            # Include
 }else{
  echo "Invalid language file";
  exit;
 }

 $langfile = $l;

 

 ?>

This will allow access only to files which are located in the same 
directory as customize.php (usually /include) and begin with lang-.


Patch:
There is a patch available at the phpMyNewsletter site:
 <http://gregory.kokanosky.free.fr/phpmynewsletter/download.php3?id=42> 
http://gregory.kokanosky.free.fr/phpmynewsletter/download.php3?id=42


ADDITIONAL INFORMATION

This information has been provided by  <mailto:eclipse@packx.net> Eclipse



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com 
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business
 profits or special damages.