Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 17 Jan 2013 00:16:26 -0700
From: Kurt Seifried <>
CC: Carlos Alberto Lopez Perez <>,
        WHK Yan <>,,,,
        1337 Exploit DataBase <>,
Subject: Re: Re: [Full-disclosure] File Disclosure in SimpleMachines
 Forum <= 2.0.3

Hash: SHA1

Ok got this translated and then promptly got back logged, sorry for
the delay.

Carlos Alberto Lopez Perez wrote:
I'm sorry, I was using google translator, I speak Spanish.
I was saying that sometimes there are admins that need help to manage
forum sections like in an smf. I am part of the <>
community, where there is only one admin and several co-admins. The
admin does not trust his own shadow and has created a special user group
from the group panel  called coadmin. This kind of user has been created
with the same permissions as an admin with the exception of package
installations and anything that might allow them to take total control
of the server, and they are restricted only to the forum tasks.
With this security breach, a user like this coadmin could be able to
access the configuration file and read the database, thus being able to
obtain the admin's session hash and later upload an ill-intentioned
shell like a c99.php.
This scenario repeats in many forums I visit, like
<> and  <>. That's why I
think it's an important security failure, since if smf is designed to
protect directories and it doesn't do it properly, allowing file reading
in an arbitrary way [Translator note: what follows might not make sense
but it doesn't make sense in Spanish either, sorry] it's because for us
it's not an isolated case  or so easy to detect, it's like the classic
scenario of "is an xss high or low impact?"; it all depends on the
scenario and in our cases it's something critical.
Thanks for your attention Mr. Kurt

Ok this makes sense, so basically you have a highly privileged forum
admin that can read files such as the database config which is a
definite problem.

Please use CVE-2013-0192 for this issue.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

Version: GnuPG v1.4.12 (GNU/Linux)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.