Date: Thu, 27 Feb 2014 14:58:21 +0100 From: Damien Cauquil <d.cauquil@...dream.com> To: cve-assign@...re.org CC: oss-security@...ts.openwall.com Subject: Re: CVE request: PLOGGER 1.0RC1 multiple vulnerabilities I think there is a mistake from our part about the "race condition". After a quick review, there is no "race condition" but simply some requirements about the zip file and a cleaning step that should not be be performed by the application in order to keep all the files on the server. Here are the steps to follow to exploit this vulnerability: 1. create a zip file containing at least one non-empty image file with a valid extension (such as .jpg) 2. upload the file through the upload form, the application will unzip it in a standard location and will tell the user about the image files found. If we go on at this step, all the extracted images will be processed and all the extracted files then deleted. So we just stop right here, and 3. access the php file extracted by the application I don't know if I'm really clear about what happens, Le 27/02/2014 14:29, cve-assign@...re.org a écrit : >> The zip file must at least contains a non-empty image file with a name >> including a valid extension, and of course the exploit php file. > > Maybe your reply means that if this "must at least" requirement is not > satisfied, then a race condition occurs. But what is the race condition: > what action is in a race against what other action? > > -- Damien Cauquil Directeur Recherche & Développement CHFI | CEH | ECSA | CEI Sysdream 108 avenue Gabriel Péri 93400 Saint Ouen Tel: +33 (0) 1 78 76 58 21 www.sysdream.com Download attachment "signature.asc" of type "application/pgp-signature" (279 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ