Gallery Input Validation Holes Let Remote Users Delete Files and Conduct Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1015717 |
|
SecurityTracker URL: http://securitytracker.com/id/1015717
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Mar 3 2006
|
Impact:
Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of system information, Modification of user information
|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
|
|
Description:
Several vulnerabilities was reported in Gallery. A remote user can inject scripting code. A remote user can delete files on the target system.
The software does not properly filter HTML code from user-supplied input in the X_FORWARDED_FOR HTTP header. A remote user can submit a specially crafted value when adding a comment. When the target user views the comment, arbitrary scripting code will be executed by the target user's browser. The code will originate from the site running the Gallery software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
A remote user can spoof identities by specifying an arbitrary X_FORWARDED_FOR HTTP header value.
The session handling class _isSessionValid() function does not properly validate user-supplied session ID cookie values. A remote user can supply a specially crafted value to cause the system to delete specified files.
James Bercegay of the GulfTech Security Research Team discovered these vulnerabilities.
The original advisory is available at:
http://www.gulftech.org/?node=research&article_id=00106-03022006
|
Impact:
A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Gallery software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
A remote user can delete files on the target system.
|
Solution:
The vendor has issued a fixed version (2.0.3), available at:
http://gallery.menalto.com/downloads
|
Vendor URL: gallery.menalto.com/ (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 2 Mar 2006 23:30:37 -0500
Subject: Gallery 2 Multiple Vulnerabilities
|
http://www.gulftech.org/?node=research&article_id=00106-03022006
|
|
