[Full-disclosure] FWD: PhotoPost vBGallery Important Security Bulletin
trains at doctorunix.com
Fri Jan 11 15:06:37 GMT 2008
Quoting "ad at heapoverflow.com" <ad at heapoverflow.com>:
> It's unclear what type of bug is it about, they are refering to an
> apache bug but since all hacks used to access the database it could be a
> SQL injection. This is critical bug.
This is sort of clever, but obvious in hindsight. If a web site has
an upload directory that is also readable, it will be vulnerable.
Normal sysadmin configurations can prevent this exposure.
Upload directories should not be directly viewable. That was the
basis for numerous exploits of frontpage systems back in the day. A
script should validate the uploaded file and separately move it to a
The reason this is an apache bug is because the default install uses
an insecure setting for php scripts (perl also).
The "AddType" statement for php is normally system-wide, which means
the web server will execute php scripts that may be found in the
upload directory. This can be fixed multiple ways:
Move the php AddType statement into a <directory> stanza, or
Set directory options for directories where we would not expect to
execute things or use a "AddType" statement in the images directory,
Options +IncludesNoExec -ExecCGI
AddType text/html .php
<Files ~ "\.php">
Deny from all
that should be redundant enough.
Email solutions, MS Exchange alternatives and extrication,
security services, systems integration.
Contact: services at doctorunix.com
Full-Disclosure is hosted and sponsored by Secunia.