Publié le 03-07-2009 18:07 sur la mailing-list Bugtraq

Pub : Découvrez les Labs ZATAZ

#2009-007 FCKeditor input sanitization errors

Description:

FCKeditor, a web based open source HTML text editor, suffers from a remote
file upload vulnerability.

The input of several connector modules is not properly verified before being
used, this leads to exposure of the contents of arbitrary directories on the
server filesystem and allows file uploading to arbitrary locations. The
affected code is remotely exposed before authentication. An attacker can
exploit this vulnerability to install remote shells on the victim server
among other things, it should be noted that this vulnerability is being
actively exploited in the wild.

Additionally several XSS vulnerabilities are present in the packaged samples
directory.

A patch and a new FCKeditor version will be made available on Monday July 6th
16:00 CET, this advisory will be updated with detailed information about the
issue and a security patch.

In the meantime we strongly recommend to implement the following
mitigation instructions:

* removed unused connectors from 'editorfilemanagerconnectors'

* disable the file browser in config.ext

* inspect all fckeditor folders on the server for suspicious files that
may have been previously uploaded, as an example image directories
(eg. 'fckeditor/editor/images/...') are well known target locations
for remote php shells with extensions that match image files

* completely remove the '_samples' directory

Affected version:

FCKeditor <= 2.6.4

(version 3.0 is unaffected as it does not have any built-in file browser)

Fixed version:

FCKeditor >= 2.6.4.1 (to be released on 2009-07-06 16:00 CET)

Credit: vulnerability report received from Vinny Guido <bigvin [at]
hushmail [dot] com>.

CVE: CVE-2009-2265

Timeline:

2009-05-03: vulnerability reported received
2009-05-04: contacted fckeditor maintainer
2009-05-25: maintainer denies reported issues against latest version
2009-05-25: reporter confirms that latest version is affected
2009-06-21: maintainer forwards report to project security maintainer
2009-06-23: security maintainer confirms CurrentFolder vulnerability
2009-06-24: security maintainer provides patch
2009-06-29: assigned CVE
2009-07-03: preliminary advisory release with mitigation instructions due to
wide exposure of the issue

Permalink:
http://www.ocert.org/advisories/ocert-2009-007.html

--
Andrea Barisani | Founder & Project Coordinator
oCERT | Open Source Computer Emergency Response Team

<[email protected]> http://www.ocert.org
0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E
"Pluralitas non est ponenda sine necessitate"

L´ANSSI recrute de manière originale

06-02-2012 à 19:16 - 0 commentaire(s)

INFO ZATAZ - L´Agence Nationale de la Sécurité des Système d'Information lance un recrutement fort sympathique pour les amateurs de chiffrement.

Nouvelle attaque à l´encontre des clients du Crédit Agricole

05-02-2012 à 10:43 - 0 commentaire(s)

INFO ZATAZ - Nouvelle tentative de vol de données bancaires appartenant aux clients de la banque française Crédit Agricole.

Sauvegarde des conversations téléphoniques pour France télévision

04-02-2012 à 11:42 - 0 commentaire(s)

INFO ZATAZ - Un document intéressant mis à jour sur Internet visant les sociétés souhaitant faire du business avec France Télévision.

Faille sur le site Wikileaks

04-02-2012 à 11:27 - 0 commentaire(s)

INFO ZATAZ - Une faille sur le site Wikileaks permet d´afficher n´importe quoi, donc de fausses informations, sur le portail international d´information.

Piège sur Facebook

04-02-2012 à 10:59 - 0 commentaire(s)

INFO ZATAZ - Un escroc se fait passer pour Coca Cola, sur Facebook, afin de mettre la main sur vos données privées.

Arnaque aux logements

04-02-2012 à 10:53 - 0 commentaire(s)

INFO ZATAZ - Depuis quelques heures, un escroc tente de louer de faux appartements en région parisienne. ZATAZ vous l´a délogé.

Une conférence téléphonique du FBI piratée par des Anonymous

04-02-2012 à 10:21 - 1 commentaire(s)

INFO ZATAZ - Une conférence téléphonique entre FBI et plusieurs polices européennes, dont la France, au sujet des Anonymous, interceptée.

La Ville de Chambéry corrige une fuite de données

04-02-2012 à 10:05 - 1 commentaire(s)

INFO ZATAZ - Avec l´aide du CERTA, le site Internet de la ville de Chambéry bouche une fuite de données concernant les administrés de cette commune Française.