From advisory@stgsecurity.com Tue Jul 8 17:27:17 2003 From: SSR Team To: SecurityTracker , SecuriTeam , Secunia , Packet Storm Security , Full Disclosure , BugTraq Date: Tue, 8 Jul 2003 21:05:30 +0900 Subject: [Full-Disclosure] STG Security Advisory: [SSA-20030701-03] ChangshinSoft ezTrans Server File Download Vulnerability [ The following text is in the "euc-kr" character set. ] [ Your display is set for the "US-ASCII" character set. ] [ Some characters may be displayed incorrectly. ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 STG Security Advisory: [SSA-20030701-03] ChangshinSoft ezTrans Server File Download Vulnerability Revision 1.1 Date Published: 2003-07-08 (KST) Last Update: 2003-07-08 Disclosed by SSR Team (advisory@stgsecurity.com) Synopsis ======== ezTrans Server, used by famous portal sites in Korea, is a real-time Korean-to-Japanese and Japanese-to-Korean translator made by ChangshinSoft. For inappropriate input validation in a file download module of ezTrans Server, an attacker can download files accessible to web server privilege. Vulnerability Class =================== Implementation Error: Inappropriate Input Validation Details ======= For inappropriate input validation in a file download module of ezTrans Server, an attacker can download files accessible to web server privilege. Proof of Concept: http://[victim site]/question/crm/download.php?filename=../../../../../../../../../../../.. /etc/passwd http://[victim site]/download.php?filename=../../../../../../../../../../../../../etc/passw d Exploiting this vulnerability, an attacker can download files which include critical information and damage a portal site with another vulnerable web application. Impact ====== An attacker can read critical information on the victim site. Using this vulnerability and exploiting another vulnerable web applications, a malicious attacker can dispossess a web server. Workaround ========== It's very difficult to program secure web applications in PHP. Nonetheless you can minimize security problems by setting php.ini up appropriately. To minimize the effects of this vulnerability, we recommend following workarounds. 1. Turn register_globals option in php.ini OFF. For detailed information, refer to below sites. 2. Delete the vulnerable download.php and use static link to a file to download inside your HTML source. References Study in Scarlet - http://www.securereality.com.au/studyinscarlet.txt Securing PHP: Step-by-step - http://www.securityfocus.com/infocus/1706 Affected Products ================ ezTrans Server Vendor Status: FIXED =================== 2003-06-24 CSSoft notified. 2003-06-26 Second attempt at vendor and system administrator contact. 2003-07-02 Third attempt at vendor contact. 2003-07-04 Forth attempt at vendor contact. 2003-07-04 Vendor replied. 2003-07-04 Last attempt at vendor contact. 2003-07-04 Vendor fixed. 2003-07-08 Public disclosure Credits ====== Jeremy Bae at STG Security SSR Team About STG Security ================= STG Security Inc. is a affiliated company of STG Group which has its head office in the States founded in march 2000. Its core business area is professional penetration testing, security code review and BS7799 consulting services. http://www.stgsecurity.com/ Phone +82-2-6333-4500 FAX +82-2-6333-4545 -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQA/AwUBPwqzUT9dVHd/hpsuEQKD/gCfYNKIf1bGN+7rnCXVlCXvOg5ZbYEAoKQC u8a2PadV9zd17EIQDQUuVU1y =pnDg -----END PGP SIGNATURE----- [ Part 2, Text/PLAIN (Name: "CSSoft-EZTRansI-Eng.txt") 104 lines. ] [ Unable to print this part. ]