FUDforum Avatar Upload Arbitrary Script Upload Vulnerability

Bugtraq ID:	14678
Class:	Input Validation Error
CVE:	CVE-2005-2781
Remote:	Yes
Local:	No
Published:	Aug 29 2005 12:00AM
Updated:	May 25 2009 07:20PM
Credit:	Discovery is credited to <[email protected]>.
Vulnerable:	PHPGroupWare PHPGroupWare 0.9.16 .000 PHPGroupWare PHPGroupWare 0.9.14 Ilia Alshanetsky FUDForum 2.7 Ilia Alshanetsky FUDForum 2.6.15 Ilia Alshanetsky FUDForum 2.6.14 Ilia Alshanetsky FUDForum 2.6.13 Ilia Alshanetsky FUDForum 2.6.12 Ilia Alshanetsky FUDForum 2.6.10 Ilia Alshanetsky FUDForum 2.6.9 Ilia Alshanetsky FUDForum 2.6.8 Ilia Alshanetsky FUDForum 2.6.7 Ilia Alshanetsky FUDForum 2.6.5 Ilia Alshanetsky FUDForum 2.6.4 Ilia Alshanetsky FUDForum 2.6.3 Ilia Alshanetsky FUDForum 2.6.2 Ilia Alshanetsky FUDForum 2.6.1 Ilia Alshanetsky FUDForum 2.6 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0
Not Vulnerable:

FUDforum Avatar Upload Arbitrary Script Upload Vulnerability

FUDforum is prone to a remote arbitrary PHP file-upload vulnerability.

An attacker can merge an image file with a script file and upload it to an affected server.

This issue can facilitate unauthorized remote access.

Versions prior to FUDforum 2.7.1 are reported affected. Currently, Symantec cannot confirm if version 2.7.1 is affected as well.

FUDforum Avatar Upload Arbitrary Script Upload Vulnerability

Attackers can use a web browser to exploit this issue.

FUDforum Avatar Upload Arbitrary Script Upload Vulnerability

Solution:
Updates are available. Please see the references for more information.


PHPGroupWare PHPGroupWare 0.9.14

• Debian phpgroupware-addressbook_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-addressbook_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-admin_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-admin_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-api-doc_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-api-doc_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-api_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-api_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-bookkeeping_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-bookkeeping_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-bookmarks_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-bookmarks_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-brewer_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-brewer_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-calendar_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-calendar_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-chat_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-chat_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-chora_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-chora_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-comic_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-comic_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-core-doc_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-core-doc_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-core_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-core_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-developer-tools_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-developer-tools_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-dj_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-dj_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-eldaptir_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-eldaptir_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-email_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-email_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-filemanager_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-filemanager_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-forum_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-forum_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-ftp_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-ftp_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-headlines_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-headlines_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-hr_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-hr_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-img_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-img_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-infolog_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-infolog_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-inv_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-inv_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-manual_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-manual_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-messenger_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-messenger_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-napster_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-napster_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-news-admin_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-news-admin_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-nntp_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-nntp_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-notes_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-notes_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-phonelog_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-phonelog_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-phpsysinfo_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-phpsysinfo_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-phpwebhosting_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-phpwebhosting_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-polls_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-polls_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-preferences_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-preferences_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-registration_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-registration_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-setup_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-setup_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-skel_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-skel_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-soap_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-soap_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-stocks_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-stocks_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-todo_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-todo_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-tts_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-tts_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-wap_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-wap_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-weather_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-weather_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware-xmlrpc_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-xmlrpc_0.9.14-0.RC3.2.woody6_all.deb


• Debian phpgroupware_0.9.14-0.RC3.2.woody6_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re_0.9.14-0.RC3.2.woody6_all.deb

FUDforum Avatar Upload Arbitrary Script Upload Vulnerability

References:

• FUDforum Homepage (FUDforum)
  
• FUD Forum < 2.7.1 PHP code injection vurnelability ([email protected])
  
• Re: FUD Forum < 2.7.1 PHP code injection vurnelability ([email protected])