TITLE:
PHP iCalendar File Inclusion and Calendar Upload Vulnerabilities

SECUNIA ADVISORY ID:
SA19285

VERIFY ADVISORY:
http://secunia.com/advisories/19285/

CRITICAL:
Highly critical

IMPACT:
Exposure of sensitive information, System access

WHERE:
>From remote

SOFTWARE:
PHP iCalendar 2.x
http://secunia.com/product/5991/

DESCRIPTION:
rgod has discovered two vulnerabilities in PHP iCalendar, which can
be exploited by malicious people to disclose potentially sensitive
information and to compromise a vulnerable system.

1) Input passed to the "cookie_language" and the "cookie_style"
parameters in the "phpicalendar" cookie is not properly verified
before being used to include files. This can be exploited to include
arbitrary files from local resources.

The vulnerability may be related to:
SA17328

2) Missing access control to the calendar upload directory can be
exploited to upload arbitrary PHP files by passing a
specially-crafted PUT request with a filename containing a NULL
character in the "X-WR-CALNAME" parameter to publish.ical.php.

Successful exploitation requires that "phpicalendar_publishing" is
set to 1 in config.inc.php.

The vulnerabilities have been confirmed in version 2.21. Other
versions may also be affected.

SOLUTION:
Edit the source code to ensure that input is properly sanitised.
Disable the calendar upload functionality.

PROVIDED AND/OR DISCOVERED BY:
rgod

ORIGINAL ADVISORY:
http://www.milw0rm.com/exploits/1585
http://www.milw0rm.com/exploits/1586

OTHER REFERENCES:
SA17328:
http://secunia.com/advisories/17328/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------