OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Cgisecurity.com advisory on dcforum
From: admincgisecurity.com
Date: Tue Nov 14 2000 - 09:47:18 CST


The staff of cgisecurity.com have found a remote input validation
error in the dcforum cgi script.

NOTE: The vendor was very quick to issue a patch on this and becuase of
this i decided to release it so soon after finding it.
Below is a paste of the advisory.

-zenomorph

                        [Cgi Security Advisory #2]
                          admincgisecurity.com
                       DCForum Major security issues

Found
November 16th 2000
11:30am

Vendor contacted
1:20am
Vendor patch issued
1:44am

Public release
November 2000

Script Effected: DCForum
Price: $69 Personal, $99 Commercial

Versions effected:
All versions of DCForum
1.0 - 6.0(Current)

Platforms:
UNIX, Linux, Windows NT,
and Windows 2000

Vendor
http://www.dcscripts.com
Patch
http://www.dcscripts.com/dcforum/dcfNews/124.html

1. Impact

Any file can be read with the permissions of user nobody(or webserver)
Posible root comprimise in /dcforum/dcboard.cgi script.Command execution
is not allowed. (Read Only) This has only been tested on unix and linux
versions and is unknown if windows versions are effected.

2. Damage caused

It causes the deletion of dcboard.cgi if you ask it to view its own
source.
Cause for this is unknown as of now since I do not have the source.

For the above reason I cannot release the exploit itself at this point in
time. I would release it but it caused to much damage by "clicking on a
link". If it simply gave you passwd file that would be one thing but it
deleted a data and perhaps more not know of yet.

3. Fixes

The vendor has been contacted about this serious security problem.
A patch was issues within 1 hour of the finding of this hole.
This vendor was quick to respond.

http://www.dcscripts.com/dcforum/dcfNews/124.html
Below is a copy of the vendor patch as issued on there website.
********************************PATCH**************************************

1. DCForum Security Bug!!! Nov-14-00 01:44 AM
        DCForum Security Alert!!! Affects all versions of DCForum.
        ==================================

        An anonymous user has reported a security alert. Please make this
update
        as soon as possible.

        FIX - In dcboard.cgi and dcadmin.cgi, after

        $r_in = \%in;

        ADD

        $r_in->{'forum'} =~ s/\W//g;

        Please apply this patch as soon as possible.

        David

Published to the Public November 2000
Copyright September 2000 Cgisecurity.com