oss-security - Re: CVE request: PLOGGER 1.0RC1 multiple vulnerabilities

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 27 Feb 2014 14:58:21 +0100
From: Damien Cauquil <d.cauquil@...dream.com>
To: cve-assign@...re.org
CC: oss-security@...ts.openwall.com
Subject: Re: CVE request: PLOGGER 1.0RC1 multiple vulnerabilities

I think there is a mistake from our part about the "race condition".
After a quick review, there is no "race condition" but simply some
requirements about the zip file and a cleaning step that should not be
be performed by the application in order to keep all the files on the
server.

Here are the steps to follow to exploit this vulnerability:

1. create a zip file containing at least one non-empty image file with a
valid extension (such as .jpg)
2. upload the file through the upload form, the application will unzip
it in a standard location and will tell the user about the image files
found. If we go on at this step, all the extracted images will be
processed and all the extracted files then deleted. So we just stop
right here, and
3. access the php file extracted by the application

I don't know if I'm really clear about what happens,

Le 27/02/2014 14:29, cve-assign@...re.org a écrit :
>> The zip file must at least contains a non-empty image file with a name
>> including a valid extension, and of course the exploit php file.
> 
> Maybe your reply means that if this "must at least" requirement is not
> satisfied, then a race condition occurs. But what is the race condition:
> what action is in a race against what other action?
> 
> 

-- 
Damien Cauquil
Directeur Recherche & Développement
CHFI | CEH | ECSA | CEI

Sysdream
108 avenue Gabriel Péri
93400 Saint Ouen
Tel: +33 (0) 1 78 76 58 21
www.sysdream.com

Download attachment "signature.asc" of type "application/pgp-signature" (279 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.