exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

CSSoft-EZTRansI-Eng.txt

CSSoft-EZTRansI-Eng.txt
Posted Jul 9, 2003
Authored by STG Security | Site stgsecurity.com

STG Security Advisory SSA-20030701-03: ezTrans Server, the popular portal software used throughout Korea, lacks input validation in the file download module. Due to this, a remote attacker can download any file on the system that the webserver uid can access.

tags | exploit, remote
SHA-256 | d492993f68980b4e668ff2b3131e085ae25dd8e90d2b29a666435ba1b92fbcf3

CSSoft-EZTRansI-Eng.txt

Change Mirror Download
STG Security Advisory: [SSA-20030701-03] ChangshinSoft ezTrans Server File
Download Vulnerability

Revision 1.1
Date Published: 2003-07-08 (KST)
Last Update: 2003-07-08
Disclosed by SSR Team (advisory@stgsecurity.com)


Synopsis
========
ezTrans Server, used by famous portal sites in Korea, is a real-time
Korean-to-Japanese and Japanese-to-Korean translator made by ChangshinSoft.
For inappropriate input validation in a file download module of ezTrans
Server, an attacker can download files accessible to web server privilege.

Vulnerability Class
===================
Implementation Error: Inappropriate Input Validation

Details
=======
For inappropriate input validation in a file download module of ezTrans
Server, an attacker can download files accessible to web server privilege.

Proof of Concept:
http://[victim
site]/question/crm/download.php?filename=../../../../../../../../../../../..
/etc/passwd

http://[victim
site]/download.php?filename=../../../../../../../../../../../../../etc/passw
d

Exploiting this vulnerability, an attacker can download files which
include critical information and damage a portal site with another
vulnerable web application.

Impact
======
An attacker can read critical information on the victim site.
Using this vulnerability and exploiting another vulnerable web applications,
a malicious attacker can dispossess a web server.

Workaround
==========
It's very difficult to program secure web applications in PHP. Nonetheless
you can minimize security problems by setting php.ini up appropriately.

To minimize the effects of this vulnerability, we recommend following
workarounds.

1. Turn register_globals option in php.ini OFF. For detailed information,
refer to below sites.
2. Delete the vulnerable download.php and use static link to a file
to download inside your HTML source.

References
Study in Scarlet - http://www.securereality.com.au/studyinscarlet.txt
Securing PHP: Step-by-step - http://www.securityfocus.com/infocus/1706

Affected Products
================
ezTrans Server

Vendor Status: FIXED
===================
2003-06-24 CSSoft notified.
2003-06-26 Second attempt at vendor and system administrator contact.
2003-07-02 Third attempt at vendor contact.
2003-07-04 Forth attempt at vendor contact.
2003-07-04 Vendor replied.
2003-07-04 Last attempt at vendor contact.
2003-07-04 Vendor fixed.
2003-07-08 Public disclosure


Credits
======
Jeremy Bae at STG Security SSR Team

About STG Security
=================
STG Security Inc. is a affiliated company of STG Group which has its head
office in the States founded in march 2000. Its core business area is
professional penetration testing, security code review and BS7799 consulting
services.

http://www.stgsecurity.com/

Phone +82-2-6333-4500
FAX +82-2-6333-4545

Login or Register to add favorites

File Archive:

January 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    0 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    5 Files
  • 4
    Jan 4th
    5 Files
  • 5
    Jan 5th
    9 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    0 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    18 Files
  • 10
    Jan 10th
    31 Files
  • 11
    Jan 11th
    30 Files
  • 12
    Jan 12th
    33 Files
  • 13
    Jan 13th
    25 Files
  • 14
    Jan 14th
    0 Files
  • 15
    Jan 15th
    0 Files
  • 16
    Jan 16th
    7 Files
  • 17
    Jan 17th
    25 Files
  • 18
    Jan 18th
    38 Files
  • 19
    Jan 19th
    6 Files
  • 20
    Jan 20th
    21 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    24 Files
  • 24
    Jan 24th
    68 Files
  • 25
    Jan 25th
    22 Files
  • 26
    Jan 26th
    20 Files
  • 27
    Jan 27th
    17 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    20 Files
  • 31
    Jan 31st
    31 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close