Remote exploit in Gallery 1.3.1, 1.3.2, 1.3.3, 1.4 and 1.4.1

[Bharat Mediratta]

(Big thanks to Fred [vrotogel] for discovering this vulnerability
and alerting us before posting )

___________________
PROBLEM DESCRIPTION

Gallery is an open source image management system written in PHP.
Learn more about it at http://gallery.sourceforge.net

Starting in release 1.3.1, Gallery includes code to simulate the
behaviour of register_globals in environments where that setting
is disabled. We do this by extracting the values of the various
$HTTP_ global variables into the global namespace. We check
for the presence of certain types of malicious data before doing
this, but our checks are inadequate.

A clever hacker can circumvent our checks by crafting a URL like
this:

http://example.com/gallery/init.php?HTTP_POST_VARS=xxx

this causes our register_global simulation code to overwrite
the HTTP_POST_VARS which, when it in turn is extracted will
deliver the payload. If the payload compromises $GALLERY_BASEDIR
then the malicious user can perform a PHP injection exploit and
gain remote access to your box as the webserver/PHP user id.

_________________
VERSIONS AFFECTED

This vulnerability affects Gallery releases 1.3.1, 1.3.2, 1.3.3,
1.4 and 1.4.1. It has been fixed in Gallery v1.4.1-pl1, v1.4.2
(not yet released) and in the CVS HEAD. We strongly recommend
that all users upgrade to Gallery v1.4.1-pl1 ASAP.

__________________
FIXING THE PROBLEM

There are three different ways you can resolve this problem.

1. Replace init.php and setup/init.php with the files from this zip:

http://prdownloads.sourceforge.net/gallery/patch_1.4.1-to-1.4.1-pl1.zip?download

-or-

2. Upgrade to Gallery 1.4.1-pl1:

http://sourceforge.net/project/showfiles.php?group_id=7130&package_id=7239&release_id=212324


-or-

3. Follow the instructions in this news article:
http://gallery.sourceforge.net/article.php?sid=107
to manually patch the two affected files. (won't take more
than a couple of minutes).


regards,
Bharat Mediratta
Gallery developer

[Matus UHLAR - fantomas]

This mail is meaned to blame, not to flame...

On 27.01 14:29, Bharat Mediratta wrote:
> Starting in release 1.3.1, Gallery includes code to simulate the
> behaviour of register_globals in environments where that setting
> is disabled. We do this by extracting the values of the various
> $HTTP_ global variables into the global namespace. We check
> for the presence of certain types of malicious data before doing
> this, but our checks are inadequate.

According to PHP documentation
(http://www.php.net/manual/en/security.registerglobals.php) the
register_globals variable now defaults to off because of security reasons.

I can't understand, why, instead of fixing scripts not to use that feature
and thus to be more secure, should anyone try to emulate that unsafe
option by script (and possibly make it even more insecure, as it was
exactly done). That seems absurd and non-sense to me:

"Argh! They removed a thing it because it's unsecure. Let's get it back..."

> A clever hacker can circumvent our checks by crafting a URL like
> this:
>
> http://example.com/gallery/init.php?HTTP_POST_VARS=xxx
>
> this causes our register_global simulation code to overwrite
> the HTTP_POST_VARS which, when it in turn is extracted will
> deliver the payload. If the payload compromises $GALLERY_BASEDIR
> then the malicious user can perform a PHP injection exploit and
> gain remote access to your box as the webserver/PHP user id.

I hope that PHP coders will have their lesson now.

--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Linux - It's now safe to turn on your computer.
Linux - Teraz mozete pocitac bez obav zapnut.