[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 10 Nov 2008 19:04:08 +0100
From: Christian Hoffmann <hoffie@...too.org>
To: oss-security@...ts.openwall.com
CC: mail@...ianw.de
Subject: GeSHi: Clarification about the recent security (non-)issues (SA32559)
Heya,
I was reading up on Secunia Advisory 32559 [1] and the related upstream
statement [2] and ChangeLog [3] and well, it left me with some mixed
impressions, what's true and what not, so I took a closer look.
The facts:
* Secunia says: "unspecified error, which may allow execution of
arbitrary code"
* Upstream's ChangeLog [3] says: "Fixed a problem allowing Remote
Code Inclusion under certain circumstances (BenBE)"
* Upstream's news entry [2] says that the exploitation of
this issue requires that an attacker already has access to the
system
So, with little concrete information being available, I took a look at
the diff [4]. As I understand it, a function (set_language_path()) did
not check the parameter, which it got passed, which made it possible to
inject data into a string, which would later be used by "include" or a
similar construct. This would allow for using certain stream wrappers
like http:// or php:// to load user-supplied data as PHP code.
So, *if* a user has the possibility to pass a crafted string to
set_language_path(), this might allow for later remote (PHP) code execution.
GeSHi calls this function in its constructor with the passed $path
argument, which is not untrusted per-se. So GeSHi alone does not make
this a vulnerability.
Webapps could pass user-supplied data to this parameter, but this sounds
unlikely (and not that smart...). So if at all, I'd consider this a
vulnerability in a web app, which passes user-supplied input to this
parameter.
These are just my findings after having a quick look at the code, and I
thought I'd shared them, just in case someone wondered (and please
protest, if you think I'm wrong).
JFYI: Dokuwiki and phpBB are examples of software packages, which bundle
GeSHi. Dokuwiki passes a static string to the mentioned $path parameter
and is not vulnerable as such. I haven't checked phpBB.
[1] http://secunia.com/advisories/32559/
[2] http://qbnz.com/highlighter/news.php?id=119
[3] http://sourceforge.net/project/shownotes.php?release_id=637321
[4]
http://geshi.svn.sourceforge.net/viewvc/geshi/trunk/geshi-1.0.X/src/geshi.php?r1=1747&r2=1750
--
Christian Hoffmann
Download attachment "signature.asc" of type "application/pgp-signature" (261 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
