YaBB search.pl Arbitrary Command Execution Vulnerability
BID:1921
Info
YaBB search.pl Arbitrary Command Execution Vulnerability
| Bugtraq ID: | 1921 |
| Class: | Input Validation Error |
| CVE: |
CVE-2000-1176 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Nov 07 2000 12:00AM |
| Updated: | Jul 11 2009 03:56AM |
| Credit: | Reported to bugtraq by rpc <[email protected]> on Tue, Nov 7, 2000. |
| Vulnerable: |
YaBB YaBB 9.11.2000 |
| Not Vulnerable: |
YaBB YaBB 1 Gold Release |
Discussion
YaBB search.pl Arbitrary Command Execution Vulnerability
YaBB (Yet Another Bulletin Board) is a popular perl-based bulletin board scripting package.
search. pl, one of several perl scripts which comprise YaBB, fails to properly validate user input which arguments a call to open().
A malicious user could supply a string containing '/../'-type sequences and shell commands. As a result of search.pl's failure to reject this type of input, it is possible to traverse the script's normal working directories, and to execute arbitrary commands on the host with the privelege level of YaBB. This can lead to an anonymous internet user gaining shell access to the host.
YaBB (Yet Another Bulletin Board) is a popular perl-based bulletin board scripting package.
search. pl, one of several perl scripts which comprise YaBB, fails to properly validate user input which arguments a call to open().
A malicious user could supply a string containing '/../'-type sequences and shell commands. As a result of search.pl's failure to reject this type of input, it is possible to traverse the script's normal working directories, and to execute arbitrary commands on the host with the privelege level of YaBB. This can lead to an anonymous internet user gaining shell access to the host.
Exploit / POC
YaBB search.pl Arbitrary Command Execution Vulnerability
An attacker could easily create a malicious html form with a catsearch such as:
./../../../../../usr/bin/touch%20/tmp/foo|
(excerpted from bugtraq posting by rpc <[email protected]>)
An attacker could easily create a malicious html form with a catsearch such as:
./../../../../../usr/bin/touch%20/tmp/foo|
(excerpted from bugtraq posting by rpc <[email protected]>)
Solution / Fix
YaBB search.pl Arbitrary Command Execution Vulnerability
Solution:
This issue has been addressed in the latest release of YaBB:
YaBB YaBB 9.11.2000
Solution:
This issue has been addressed in the latest release of YaBB:
YaBB YaBB 9.11.2000
-
YaBB Y1Gold_Release_cgi
.cgi Version
http://yabb.xnull.com/downloads.php?file=./downloads/Y1Gold_Release_cg i.zip -
YaBB Y1Gold_Release_pl
.pl Version
http://yabb.xnull.com/downloads.php?file=./downloads/Y1Gold_Release_pl .zip
References
YaBB search.pl Arbitrary Command Execution Vulnerability
References:
References: