[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] Re: CVE request: PLOGGER 1.0RC1 multiple vulnerabilities
From:       Damien Cauquil <d.cauquil () sysdream ! com>
Date:       2014-02-27 13:58:21
Message-ID: 530F447D.9070708 () sysdream ! com
[Download RAW message or body]


I think there is a mistake from our part about the "race condition".
After a quick review, there is no "race condition" but simply some
requirements about the zip file and a cleaning step that should not be
be performed by the application in order to keep all the files on the
server.

Here are the steps to follow to exploit this vulnerability:

1. create a zip file containing at least one non-empty image file with a
valid extension (such as .jpg)
2. upload the file through the upload form, the application will unzip
it in a standard location and will tell the user about the image files
found. If we go on at this step, all the extracted images will be
processed and all the extracted files then deleted. So we just stop
right here, and
3. access the php file extracted by the application

I don't know if I'm really clear about what happens,

Le 27/02/2014 14:29, cve-assign@mitre.org a écrit :
>> The zip file must at least contains a non-empty image file with a name
>> including a valid extension, and of course the exploit php file.
> 
> Maybe your reply means that if this "must at least" requirement is not
> satisfied, then a race condition occurs. But what is the race condition:
> what action is in a race against what other action?
> 
> 

-- 
Damien Cauquil
Directeur Recherche & Développement
CHFI | CEH | ECSA | CEI

Sysdream
108 avenue Gabriel Péri
93400 Saint Ouen
Tel: +33 (0) 1 78 76 58 21
www.sysdream.com


["signature.asc" (application/pgp-signature)]

[prev in list] [next in list] [prev in thread] [next in thread]