A fake image header with actual html body content was able to get past phpbb's input validation. An exploit was issued for phpbb a month ago and that sparked me to check some other webapps. vbulletin 3.5.0 forum file attachments did not sanitize against this, as a result Jelsoft quickly issued release 3.5.1 as a fix. Other branches were also fixed up to 3.0.10 and 2.3.8. http://www.vbulletin.com/forum/showthread.php?postid=1002384 "The first flaw is in Microsoft Internet Explorer. It affects vBulletin image uploads and potentially opens a cross-site-scripting exploit. It has affected many web-based applications that allow image uploads, including phpBB and Hotmail. Although a fix from Microsoft would be preferable, we have implemented a work-around in all three branches of vBulletin to prevent the Internet Explorer flaw from being exploited." drupal 4.6.3 was also tested and found to be vulnerable as well. http://drupal.org/node/39355 "Paul Laudanski informed us that it's possible to attach files that are able to run Javascript under Internet Explorer. Further investigation of the problem revealed that the same method can be used to inject arbitrary HTTP headers." Subsequently, all branches were fixed up to: 4.5.6, and 4.6.4. However, PHP 4.3.0 is also required in this solution. Credit: CastleCops.com -- Paul Laudanski, Microsoft MVP Windows-Security [de] http://de.castlecops.com [en] http://castlecops.com [wiki] http://wiki.castlecops.com [family] http://cuddlesnkisses.com
This archive was generated by hypermail 2.1.3 : Wed Nov 30 2005 - 17:33:17 PST