Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 30 Aug 2013 02:46:48 -0400 (EDT)
Subject: Re: YingZhi Python Programming Language for iOS ftp .. bug & httpd arbitrary upload

Hash: SHA1

> I'd like to request a CVE for these vulnerabilities I disclosed back
> on Sept 27 2012.
> YingZhi Python Programming Language for iOS
> Vendor: XiaoWen Huang, YingZhi Python for iOS.
> Ver 1.9.
> OSVDB IDs: 96719 & 96720
> Product Websites
> YingZhi
> Python Interpreter is a native python development application for the
> iPad/iPhone. It is available for iOS 4 and above.
> The product is packaged with its own httpd and ftpd servers. Enabling
> the local daemons for development by Touching Computer<->This Machine
> starts up an httpd server and ftpd server, both daemons are bound to
> device IP not localhost.

> httpd server allows upload of arbitrary files to root WWW directory.
> Browsing to http://<target_ip>:8080/ presents an index page in which
> anyone can upload files to the web servers root directory.

Use CVE-2013-5654. Support for anonymous upload is, at least, rare in
HTTP servers and this behavior would seem to violate reasonable user

If you have any further information about the specific statements in
OSVDB entry 96720, please let us know. For example, have you confirmed
that the default configuration of this HTTP server enables a PHP
interpreter, such that uploads of .php files are especially dangerous?

> ftp server vulnerable to ../ bug
> The ftp server doesn't sanitize user input and allows remote users to
> read and possibly write to the devices storage.

Use CVE-2013-5655.

> The ftp server doesn't bother authenticating users, any
> username/password combination will allow you in.

We're not immediately assigning a CVE ID for this authentication
behavior because it might be an intentional part of the vendor's
design, and might have been reasonable in the vendor's envisioned
development environment. If there is any documentation suggesting that
this is instead an authentication bypass (e.g., the product allows the
user to configure a username/password combination), the assignment can
of course be reconsidered.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through ]
Version: GnuPG v1.4.14 (SunOS)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.