TWiki Search Shell Metacharacter Remote Arbitrary Command Execution Vulnerability
BID:11674
Info
TWiki Search Shell Metacharacter Remote Arbitrary Command Execution Vulnerability
| Bugtraq ID: | 11674 |
| Class: | Input Validation Error |
| CVE: |
CVE-2004-1037 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 12 2004 12:00AM |
| Updated: | Jul 12 2009 08:06AM |
| Credit: | Discovery is credited to Markus Goetz, Joerg Hoh, Michael Holzt, Florian Laws, Hans Ulrich Niedermann, Andreas Thienemann, Peter Thoeny, and Florian Weimer. |
| Vulnerable: |
TWiki TWiki 20040901 TWiki TWiki 20030201 TWiki TWiki 01-Feb-2003 TWiki TWiki 01-Dec-2001 TWiki TWiki 01-Dec-2000 Gentoo Linux |
| Not Vulnerable: |
TWiki TWiki 20040902 |
Discussion
TWiki Search Shell Metacharacter Remote Arbitrary Command Execution Vulnerability
TWiki is reported prone to a shell metacharacter remote command execution vulnerability. This issue may allow an attacker gain unauthorized access to a vulnerable computer by executing arbitrary commands.
TWiki 20030201 is reported vulnerable to this issue, however, it is likely that other versions are affected as well.
TWiki is reported prone to a shell metacharacter remote command execution vulnerability. This issue may allow an attacker gain unauthorized access to a vulnerable computer by executing arbitrary commands.
TWiki 20030201 is reported vulnerable to this issue, however, it is likely that other versions are affected as well.
Exploit / POC
TWiki Search Shell Metacharacter Remote Arbitrary Command Execution Vulnerability
An exploit is not required.
The following examples are available:
doesnotexist1'; (uname -a; id) | sed 's/\(.*\)/__BEGIN__\1__END__.txt/'; fgrep -i -l -- 'doesnotexist2
runvirus has supplied the exploit code Twiki-20030201-exec.pl.
An exploit is not required.
The following examples are available:
doesnotexist1'; (uname -a; id) | sed 's/\(.*\)/__BEGIN__\1__END__.txt/'; fgrep -i -l -- 'doesnotexist2
runvirus has supplied the exploit code Twiki-20030201-exec.pl.
Solution / Fix
TWiki Search Shell Metacharacter Remote Arbitrary Command Execution Vulnerability
Solution:
Gentoo has released a security advisory (GLSA 200411-33) and an updated eBuild to address this vulnerability. Gentoo users are advised to execute the following sequence of commands as a superuser in order to apply the updates:
emerge --sync
emerge --ask --oneshot --verbose ">=www-apps/twiki-20040902"
Conectiva Linux has mad advisory CLA-2005:918 available dealing with this issue. Please see the referenced advisory for more information.
The vendor has made an update available dealing with this issue.
Solution:
Gentoo has released a security advisory (GLSA 200411-33) and an updated eBuild to address this vulnerability. Gentoo users are advised to execute the following sequence of commands as a superuser in order to apply the updates:
emerge --sync
emerge --ask --oneshot --verbose ">=www-apps/twiki-20040902"
Conectiva Linux has mad advisory CLA-2005:918 available dealing with this issue. Please see the referenced advisory for more information.
The vendor has made an update available dealing with this issue.
References
TWiki Search Shell Metacharacter Remote Arbitrary Command Execution Vulnerability
References:
References:
- TWiki Homepage (TWiki)
- TWiki exploit (search.pm / CAN-2004-1037) (Roman Medina-Heigl Hernandez
- TWiki search function allows arbitrary shell command execution (Hans Ulrich Niedermann