Secunia Security Advisory - Some vulnerabilities and a security issue have been reported in DotNetNuke, which can be exploited by malicious users to gain escalated privileges or to compromise a vulnerable system, and by malicious people to bypass certain security restrictions.
8b31012cf25843b19499c2b88d6b1df19a2c161fa2a76a98f5f9d40481b9d6ef
----------------------------------------------------------------------
A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI
has been released. The new version includes many new and advanced
features, which makes it even easier to stay patched.
Download and test it today:
https://psi.secunia.com/
Read more about this new version:
https://psi.secunia.com/?page=changelog
----------------------------------------------------------------------
TITLE:
DotNetNuke Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA29488
VERIFY ADVISORY:
http://secunia.com/advisories/29488/
CRITICAL:
Moderately critical
IMPACT:
Security Bypass, Privilege escalation, System access
WHERE:
>From remote
SOFTWARE:
DotNetNuke 4.x
http://secunia.com/product/12059/
DESCRIPTION:
Some vulnerabilities and a security issue have been reported in
DotNetNuke, which can be exploited by malicious users to gain
escalated privileges or to compromise a vulnerable system, and by
malicious people to bypass certain security restrictions.
1) The problem is that it is possible to upload static files, which
can then be converted into dynamic scripts. This can be exploited to
execute server-side application logic.
Successful exploitation requires access to the file manager and that
the "HTM" or "HTML" file type has been added to the default file
upload extensions.
2) An error in the file manager within the handling of allowed file
types can be exploited to upload arbitrary files and gain escalated
privileges.
Successful exploitation requires access to the file manager.
3) The problem is that under certain circumstances the
"validationkey" is not generated properly. This can be exploited to
access the portal as an arbitrary user, using the the unchanged
default "validationkey".
The security issue and vulnerabilities are reported in versions prior
to 4.8.2.
SOLUTION:
Update to version 4.8.2.
http://www.dotnetnuke.com/tabid/125/default.aspx
PROVIDED AND/OR DISCOVERED BY:
1) The vendor credits Timo Breumelhof.
2) The vendor credits Morteza Kermani.
3) Brian Holyfield
ORIGINAL ADVISORY:
http://www.dotnetnuke.com/News/SecurityBulletins/SecurityBulletinno11/tabid/1147/Default.aspx
http://www.dotnetnuke.com/News/SecurityBulletins/SecurityBulletinno12/tabid/1148/Default.aspx
http://www.dotnetnuke.com/News/SecurityBulletins/SecurityBulletinno13/tabid/1149/Default.aspx
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------