[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <50F7A54A.70307@redhat.com>
Date: Thu, 17 Jan 2013 00:16:26 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Carlos Alberto Lopez Perez <clopez@...lia.com>,
WHK Yan <yan.uniko.102@...il.com>, submit@...ecurity.com,
submissions@...ketstormsecurity.com, vuldb@...urityfocus.com,
1337 Exploit DataBase <mr.inj3ct0r@...il.com>, vuln@...unia.com
Subject: Re: Re: [Full-disclosure] File Disclosure in SimpleMachines
Forum <= 2.0.3
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Ok got this translated and then promptly got back logged, sorry for
the delay.
==================
Carlos Alberto Lopez Perez wrote:
I'm sorry, I was using google translator, I speak Spanish.
I was saying that sometimes there are admins that need help to manage
forum sections like in an smf. I am part of the <http://elhacker.net>
community, where there is only one admin and several co-admins. The
admin does not trust his own shadow and has created a special user group
from the group panel called coadmin. This kind of user has been created
with the same permissions as an admin with the exception of package
installations and anything that might allow them to take total control
of the server, and they are restricted only to the forum tasks.
With this security breach, a user like this coadmin could be able to
access the configuration file and read the database, thus being able to
obtain the admin's session hash and later upload an ill-intentioned
shell like a c99.php.
This scenario repeats in many forums I visit, like
<http://portalhacker.net> and <http://el-hacker.com>. That's why I
think it's an important security failure, since if smf is designed to
protect directories and it doesn't do it properly, allowing file reading
in an arbitrary way [Translator note: what follows might not make sense
but it doesn't make sense in Spanish either, sorry] it's because for us
it's not an isolated case or so easy to detect, it's like the classic
scenario of "is an xss high or low impact?"; it all depends on the
scenario and in our cases it's something critical.
Thanks for your attention Mr. Kurt
==================
Ok this makes sense, so basically you have a highly privileged forum
admin that can read files such as the database config which is a
definite problem.
Please use CVE-2013-0192 for this issue.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBAgAGBQJQ96VKAAoJEBYNRVNeJnmTjOsQANPPwMS5oZt3il1gEKpRq1bT
y/BXDu6R64NdG0ScGUgOGWCSbXpAkLZDoVhgqn2Ps6i8a+s9u8v81tIAuO0h+0VN
2gyM7UuRaP079IeG2T+DjfsUJEk15nIhijebDKHn01Pv1IgJYK5uRpMwEIPliT4o
8C4p5WOK042xr/HAbYW5vf5YUYGR23uzJp+PYch6NQCddVfiuCSsyo4F3O7ZVJHz
SoJqIr3cg2Ke9Ztx6fp2IGQD/NvMOznZtkDgNe5NAFIQ8qEyyaVS6d46J2a0/qRz
TuOwDWwU5WRZY6WkCVl+TlrNE9czIV1iz+y9I9PReF1KT4D+12ptx1Dv2NFR8FFR
0kdmFw6vRgj3wB+yNT+WIdwhTMpXIsuWW8Ww4swSgTqkkcuJO8U9l484x2ENmNrn
OpywRj/hmzs8U9HRm6GkfuUK8oibnBlmxyEogkUtk9uCuBA53THGcGQE1+KcoN9z
ikd1Rv2ClKuTPYondk7o27quVk5eYQdibqRnfr1NqQhCP1w7oJz83LteqGgiaBvM
RDrg/VfcDm3Bfcxcg3bDenaauXcmEmoWrtULJ3kSO21qzJk1DOXrbXLappF3aHGJ
F/gv7U/D321rgKZF7k8nL4TPeQCGrgIJZqRDZQr5XPe/HZdQsguR+KX3HUohIIzl
GJmoQqGnuAQ+yjvtVLAV
=3l16
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
