Basic Analysis and Security Engine Multiple Remote File Include Vulnerabilities

Bugtraq ID:	18298
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 06 2006 12:00AM
Updated:	Jun 06 2006 08:17PM
Credit:	str0ke is credited with the discovery of these vulnerabilities.
Vulnerable:	BASE Basic Analysis and Security Engine 1.2.4 BASE Basic Analysis and Security Engine 1.2.2 BASE Basic Analysis and Security Engine 1.2.1 BASE Basic Analysis and Security Engine 1.2
Not Vulnerable:	BASE Basic Analysis and Security Engine 1.2.5

Basic Analysis and Security Engine Multiple Remote File Include Vulnerabilities

Basic Analysis and Security Engine is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Basic Analysis and Security Engine Multiple Remote File Include Vulnerabilities

These issues can be exploited through a web client.

Basic Analysis and Security Engine Multiple Remote File Include Vulnerabilities

Solution:
These issues have been addressed in the latest upstream release. Please contact the vendor for more information.mailto:[email protected]


BASE Basic Analysis and Security Engine 1.2

• BASE base-1.2.5.tar.gz
  http://prdownloads.sourceforge.net/secureideas/base-1.2.5.tar.gz?downl oad

BASE Basic Analysis and Security Engine 1.2.1

• BASE base-1.2.5.tar.gz
  http://prdownloads.sourceforge.net/secureideas/base-1.2.5.tar.gz?downl oad

BASE Basic Analysis and Security Engine 1.2.2

• BASE base-1.2.5.tar.gz
  http://prdownloads.sourceforge.net/secureideas/base-1.2.5.tar.gz?downl oad

BASE Basic Analysis and Security Engine 1.2.4

• BASE base-1.2.5.tar.gz
  http://prdownloads.sourceforge.net/secureideas/base-1.2.5.tar.gz?downl oad

Basic Analysis and Security Engine Multiple Remote File Include Vulnerabilities

References:

• Basic Analysis and Security Engine Web Site (BASE)
  
• Debian Bug report logs - #370576 acidbase: Remote File Inclusion Vulnerabilities (David Gil)