-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 STG Security Advisory: [SSA-20041215-18] Vulnerability of uploading files with multiple extensions in phpBB Attachment Mod Revision 1.0 Date Published: 2004-12-15 (KST) Last Update: 2004-12-15 Disclosed by SSR Team (advisory@stgsecurity.com) Summary ======== phpBB Attachment Mod is file upload module for phpBB. However, an input validation flaw can cause malicious attackers to run arbitrary commands with the privilege of the HTTPD process, which is typically run as the nobody user. Vulnerability Class =================== Implementation Error: Input validation flaw Impact ====== High : arbitrary command execution. Affected Products ================ Attachment Mod 2.3.10 and prior. Vendor Status: FIXED ==================== 2004-12-08 Vulnerability found. 2004-12-08 Attachment Mod developer notified. 2004-12-13 Update version released. 2004-12-15 Official release. Details ======= Apache Mod doesn't implemented to check multiple extensions of uploaded files, e.g. attack.php.rar, so malicious attackers can upload arbitrary script files (php, pl, cgi, etc) to a web server. This is originated from a feature of Apache MIME module (mod_mime), which regards attack.php.rar as a normal PHP file and execute the file through mod_php module with the privilege of the HTTPD process. cf. http://httpd.apache.org/docs/mod/mod_mime.html - "Files with Multiple Extensions" : it's a feature, not a bug. Solution ========= Update to 2.3.11 http://www.opentools.de/board/viewtopic.php?t=3590 Vendor URL ========== http://www.opentools.de/ Credits ====== Jeremy Bae at STG Security -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQA/AwUBQcDjxD9dVHd/hpsuEQIIBACfYcy/IRJei/mfkfy+KdhQuCjhUbkAnjig p3OSX1m+9IWd+MoM8lb5IDHS =DQt1 -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html