ZoneMinder 'view' Parameter Local File Include Vulnerability

Bugtraq ID:	48949
Class:	Input Validation Error
CVE:	CVE-2013-0332
Remote:	Yes
Local:	No
Published:	Aug 01 2011 12:00AM
Updated:	Mar 14 2013 09:25PM
Credit:	iye
Vulnerable:	Triornis ZoneMinder 1.23.3 Triornis ZoneMinder 1.23.2 Triornis ZoneMinder 1.19.3 Triornis ZoneMinder 1.19.2 Triornis ZoneMinder 1.19.1 Triornis ZoneMinder 1.18.1 Triornis ZoneMinder 1.17.2 Triornis ZoneMinder 1.17.1 Triornis ZoneMinder 1.24.3 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	Triornis ZoneMinder 1.24.4

ZoneMinder 'view' Parameter Local File Include Vulnerability

ZoneMinder is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

Versions prior to ZoneMinder 1.24.4 are vulnerable.

ZoneMinder 'view' Parameter Local File Include Vulnerability

Attackers can use a browser to exploit this issue.

The following sample input is available:

http://www.example.com/zm/index.php?action=56&markMids%5B%5D=1&deleteBtn=Delete&editBtn=Edit&view=../../../../../../../../../../../../../../../etc/passwd%00

ZoneMinder 'view' Parameter Local File Include Vulnerability

Solution:
Updates are available. Please see the references for more information.

ZoneMinder 'view' Parameter Local File Include Vulnerability

References:

• IMPORTANT - Security Patch for ZM 1.24.x (Phil)
  
• lfi-patch (Triornis)
  
• lfi-patch2 (Triornis)
  
• ZoneMinder Home Page (Triornis Ltd.)