ASP, CGI, PHP, SQL... — THE HEADLINES

 2001/11/19 

ActivePerl PerlIS.dll remote buffer overflow

 2001/10/29 

Multiple Oracle flaws, patches

 2001/10/24 

Java breaks out of its sand box

 2001/8/22 

NetCode NC Book remote command execution

 2001/8/14 

Java Servlet Container cross-site scripting

ASP, CGI, PHP, SQL... — THE LINKS

• CGI Security

  Disclaimer: These hyper-links to external content may be submitted by visitors of this site. Their contents do not represent the opinion of this publication. The links will be reviewed by an editor and may be modified, rejected or deleted at any time.

ASP, CGI, PHP, SQL... — THE NEWS

2001/11/19

10:04 +0100

ActivePerl PerlIS.dll remote buffer overflow

[ASP, JSP, SQL, CGI, PHP...] NSFOCUS Security Advisory SA2001-07 (CVE CAN ID: CAN-2001-0815 / BUGTRAQ ID: 3526) discusses the finding of an exploitable buffer overflow vulnerability in a dynamic link library (perlIS.dll) of ActivePerl when handling overlong filenames. Exploiting it, an attacker could remotely execute arbitrary code.

Affected are systems with Activestate ActivePerl 5.6.1.629 and earlier versions on Microsoft IIS 4.0 or IIS5.

In case that an attacker send an overlong URL request, PerlIS would call strcpy() and copy it to a stack buffer, which would trigger a buffer overflow. Attacker could overwrite some sensitive data in the stack like returned address. With well-crafted URL request, the attacker might be able to execute arbitrary code remotely.

Exploiting this vulnerability successfully, an attack might access the IWAM_machinename account in IIS 5.0 and Local SYSTEM privilege in IIS 4.0.

Users should switch to the fixed version ActivePerl 5.6.1.630 or edit the "perlIS.dll" ISAPI extension in the Internet Service Manager and check "Check that file exists" option. // c.f. RUS-CERT, VulnWatch :: [dre].

Comments (0)

2001/10/29

15:24 +0100

Multiple Oracle flaws, patches

[ASP, JSP, SQL, CGI, PHP...] During the last week, Oracle has issued three Security Alerts, ##18-20, reporting of different vulnerabilities with a number of implications. Oracle customers should go to the world-wide support site metalink.oracle.com and obtain the respective patch(es).

[#18] Oracle9iAS Web Cache 2.0.0.1 has a vulnerability that enables an attacker to mount a denial-of-service attack using an oversized HTTP GET request. On some platforms there is an additional vulnerability that may allow remote execution of arbitrary code. CERT/CC has issued CA-2001-29 on that matter.

[#19] A potential security vulnerability has been discovered in Oracle's handling of the environment variable, ORACLE_HOME in all Oracle database server releases (8.0.x, 8.1.x and 9.0.1). A buffer overflow is
caused when the Oracle binary, otrcrep, translates the environment variable, ORACLE_HOME, into a string of 240 or more bytes. The Oracle binary otrcrep runs with the SETUID oracle privileges in the operating system DBA group. The buffer overflow may be exploited by a local user to force overwriting of stack variables in shared memory including the return memory addresses and thereby execute arbitrary (or specific, malicious) code with the privileges of the oracle user and/or the DBA group privileges.

[#20] Oracle file overwrite security vulnerability: There is a potential security vulnerability associated with the Oracle binary (all Oracle database server releases 8.0.x, 8.1.x, and 9.0.1) on several UNIX platforms. A non-privileged user (such as "nobody") invokes the oracle executable: as a result of the presence of the SETUID bit, the executable can be forced to write to a trace file in ORACLE_HOME/rdbms/log directory and thereby overwrite existing log files or create new (unauthorized) files. The non-privileged user can also point the environment variable, ORACLE_HOME, to an arbitrary directory in the operating system and thereby corrupt other files as well. // c.f. SecuriTeam, VulnWatch, RUS-CERT :: [dre].

Comments (0)

2001/10/24

10:07 +0100

Java breaks out of its sand box

[ASP, JSP, SQL, CGI, PHP...] Sun Microsystems Security Bulletin #00208 reports a vulnerability in the Java Runtime Environment (JRE), that may allow an untrusted applet to access the system clipboard.

Beside Windows, Solaris and Linux Production Releases, Netscape 6 is vulnerable if the JRE 1.3.0_02 or 1.3.0_01 is used. The default Java runtime environments of Netscape Navigator and Microsoft Internet Explorer are not vulnerable.

This issue may or may not affect other vendors' Java technology implementations which are derived from Sun's SDK source bases. Sun has notified and made the remedy available to its Java technology licensees.

Sun recommends that users of affected releases upgrade to the latest SDK and JRE releases listed in section 3 of this bulletin, which should be available soon on the Sun Security home page. // c.f. BugTraq, RUS-CERT :: [dre].

Comments (0)

2001/8/22

10:02 +0100

NetCode NC Book remote command execution

[ASP, JSP, SQL, CGI, PHP...] NetCode's GuestBook, a CGI guest book program, contains a vulnerability that allows attackers to execute arbitrary code with the security privileges the CGI runs with (usually the user 'nobody'), warns the PoizonB0x Crew.

NetCode NC Book version 0.2b is vulnerable to an exploit of the form http://target.com/cgi-bin/ncbook/book.cgi?action=default¤t=ls-la/&form_tid=996604045&prev=main.html&list_message_index=10

User should substitute the package ASAP. // c.f. SecuriTeam :: [dre].

Comments (0)

2001/8/14

09:41 +0100

Java Servlet Container cross-site scripting

[ASP, JSP, SQL, CGI, PHP...] Several products suffer from a security vulnerability that allows attackers to force the Java Servlet container to cause the server to send back JavaScript code. This allows attackers to do a cross-site scripting attack, where the user receives malicious script code coming from a trusted server, warns Hiromitsu Takagi.

Affected are —Tomcat versions 3.2.1, 3.2.2-beta, 4.0-beta, —JRun versions 2.3.3 and 3.0, —WebSphere versions 3.5 FP2, 3.02 and VisualAge for Java 3.5 Professional, —Resin version 1.2.2.

Accessing URLs like the following (varying slightly between products) will cause the JavaScript code to be executed in the browser server's domain: http://server/local-path/.jsp

Fixes/patches for the respective products have been included in Tomcat versions 4.0-beta-2 and 3.2.2-beta-5 and prepared for JRun by allaire.com, and WebSphere, patch number PQ47386V302x, at ibm.com. As a workaround, the 404 error pages should be simplified to include static information only. // c.f. SecuriTeam :: [dre].

Comments (0)