Ultimate Bulletin Board Arbitrary Command Execution Vulnerability
BID:991
Info
Ultimate Bulletin Board Arbitrary Command Execution Vulnerability
| Bugtraq ID: | 991 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 13 2000 12:00AM |
| Updated: | Feb 13 2000 12:00AM |
| Credit: | This was first posted to Bugtraq by Sergei A. Golubchik <[email protected]> on February 13, 2000. The second exploit for this problem was reported by H D Moore <[email protected]> in a post to Bugtraq on February 14, 2000. |
| Vulnerable: |
Infopop Ultimate Bulletin Board 5.43 |
| Not Vulnerable: | |
Discussion
Exploit / POC
Ultimate Bulletin Board Arbitrary Command Execution Vulnerability
See discussion.
See discussion.
Solution / Fix
Ultimate Bulletin Board Arbitrary Command Execution Vulnerability
Solution:
A quick fix is to add "$" to the end of the expression, ie:
if ($ThreadFile =~ /\d\d\d\d\d\d\.ubb$/) { ...
This will require that the value of $Threadfile end in ".ubb" to match.
This vulnerability was verified to have been fixed in the shareware version (and presumably the commercial as well).
Solution:
A quick fix is to add "$" to the end of the expression, ie:
if ($ThreadFile =~ /\d\d\d\d\d\d\.ubb$/) { ...
This will require that the value of $Threadfile end in ".ubb" to match.
This vulnerability was verified to have been fixed in the shareware version (and presumably the commercial as well).
References
Ultimate Bulletin Board Arbitrary Command Execution Vulnerability
References:
References:
- Ultimate Bulletin Board Homepage (Infopop)