Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:11502
HistoryFeb 18, 2006 - 12:00 a.m.

[SA18923] Leif M. Wright's Blog Multiple Vulnerabilities

2006-02-1800:00:00
vulners.com
18

TITLE:
Leif M. Wright's Blog Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA18923

VERIFY ADVISORY:
http://secunia.com/advisories/18923/

CRITICAL:
Highly critical

IMPACT:
Security Bypass, Cross Site Scripting, Exposure of sensitive
information, System access

WHERE:
>From remote

SOFTWARE:
Leif M. Wright Web Blog 3.x
http://secunia.com/product/8135/

DESCRIPTION:
Aliaksandr Hartsuyeu has reported some vulnerabilities in Leif M.
Wright's Blog, which can be exploited by malicious people to disclose
potentially sensitive information, bypass certain security
restrictions, conduct script insertion attacks, and potentially to
compromise a vulnerable system.

1) The default installation does not properly restrict access to
"txt" files using .htaccess. This can be exploited to retrieve the
administrator's password from the configuration file.

2) The "blog.cgi" script does not validate the password submitted via
the cookie when validating administrator access.

3) The administrative user is allowed to edit the full path to the
"sendmail" program when modifying the blog configuration. This can be
exploited to execute arbitrary shell commands and can potentially be
exploited in conjunction with vulnerability #1 to compromise a
vulnerable system.

4) Input passed in the HTTP_REFERER and HTTP_USER_AGENT HTTP request
headers isn't sanitised before being saved. This can be exploited to
execute arbitrary HTML and script code in the administrative user's
browser session in context of an affected website when the "Log" page
is viewed.

The vulnerabilities have been reported in version 3.5. Other versions
may also be affected.

SOLUTION:
Edit the source code to ensure that input is properly sanitised and
restrict access to the configuration files (e.g. with a .htaccess
file).

PROVIDED AND/OR DISCOVERED BY:
Aliaksandr Hartsuyeu

ORIGINAL ADVISORY:
http://evuln.com/vulns/82/summary.html


About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.