Recognize-Security » Advisories http://www.rec-sec.com a non-profit information security web site authored by Moshe Ben Abu (Trancer), focusing on vulnerability research, exploit development (mainly for the Metasploit Framework), web application security, information security and hacking news from around the world. Sun, 14 Mar 2010 17:44:35 +0000 http://www.rec-sec.com en hourly 1 cPanel HTTP Response Splitting Vulnerability http://www.rec-sec.com/2010/01/21/cpanel-http-response-splitting-vulnerability/ http://www.rec-sec.com/2010/01/21/cpanel-http-response-splitting-vulnerability/#comments Thu, 21 Jan 2010 05:28:10 +0000 Trancer http://www.rec-sec.com/?p=892 cPanelSecurity Advisory for cPanel and WHM (WebHost Manager) versions 11.25.
Vulnerabilities found:

  • HTTP Response Splitting vulnerability
  • Open Redirection vulnerability

PDF Format cPanel HTTP Response Splitting Vulnerability – Security Advisory (PDF).
TXT Format cPanel HTTP Response Splitting Vulnerability – Security Advisory (TXT).

I’d like to point out the lame work of the cPanel Security Team on these vulnerabilities. Usually when I report a vulnerability, I get some kind of interaction with the vendor developers and/or the security team, most of the times I enjoy working with the people involved. In this case, the cPanel Security Team were unresponsive. Eventually I was forced to release the security advisory even though one of the vulnerabilities (the Open Redirection vulnerability) is still unpatched.

References:
BID 37902
OSVDB 61954
exploit-db 11211

]]> http://www.rec-sec.com/2010/01/21/cpanel-http-response-splitting-vulnerability/feed/ 3 Caucho Resin UTF-7 Cross-Site Scripting Vulnerability http://www.rec-sec.com/2008/10/05/caucho-resin-utf-7-cross-site-scripting-vulnerability/ http://www.rec-sec.com/2008/10/05/caucho-resin-utf-7-cross-site-scripting-vulnerability/#comments Sun, 05 Oct 2008 17:11:13 +0000 Trancer http://www.rec-sec.com/?p=49 CauchoSecurity Advisory for Caucho Resin Application Server version 3.2 and below.
Vulnerabilities found:

  • UTF-7 Cross-Site Scripting

PDF Format PDF version.
TXT Format TXT version.

This actually mean that every web application hosted on a Caucho Resin application server is vulnerable to Cross-Site Scripting… If you have one, I seriously recommend you patch your server :-)

References:
Caucho Resin 3.2.1 Release Notes
Caucho bug ID 2965

]]> http://www.rec-sec.com/2008/10/05/caucho-resin-utf-7-cross-site-scripting-vulnerability/feed/ 0 OpenNMS Multiple Vulnerabilities http://www.rec-sec.com/2008/10/05/opennms-multiple-vulnerabilities/ http://www.rec-sec.com/2008/10/05/opennms-multiple-vulnerabilities/#comments Sun, 05 Oct 2008 14:02:21 +0000 Trancer http://www.rec-sec.com/?p=47 OpenNMSSecurity Advisory for OpenNMS version 1.5.93-1 and below.
Vulnerabilities found:

  • HTTP Response Splitting
  • Cross-Site Scripting

PDF Format PDF version.
TXT Format TXT version.

Also on:
BID 31577
milw0rm

]]> http://www.rec-sec.com/2008/10/05/opennms-multiple-vulnerabilities/feed/ 0 JSPWiki Multiple Vulnerabilities http://www.rec-sec.com/2008/01/15/jspwiki-multiple-vulnerabilities/ http://www.rec-sec.com/2008/01/15/jspwiki-multiple-vulnerabilities/#comments Tue, 15 Jan 2008 19:54:32 +0000 Trancer http://www.rec-sec.com/?p=51 JSPWikiSecurity Advisory for JSPWiki versions 2.4.104 (latest stable release), 2.5.139 (latest beta version) and below.
Vulnerabilities found:

  • .jsp Local File Inclusion
  • Cross-Site Scripting

JSPWiki allow users to upload (attach) files to entry pages. Combined with the LFI vulnerability, an attacker can use the information disclosed by the installation file to upload a malicious .jsp file and locally execute it.
By executing malicious server-side code, an attacker may be able to compromise the server.

Actually, this is the only published file inclusion vulnerability I’ve ever seen on a Java based web application.
Well, there’s more out there :-)

PDF Format PDF version.
TXT Format TXT version.

Also on:
BID 27785
milw0rm

]]> http://www.rec-sec.com/2008/01/15/jspwiki-multiple-vulnerabilities/feed/ 0 MediaWiki Cross-Site Scripting Vulnerabilities http://www.rec-sec.com/2007/02/18/mediawiki-cross-site-scripting-vulnerabilities/ http://www.rec-sec.com/2007/02/18/mediawiki-cross-site-scripting-vulnerabilities/#comments Sun, 18 Feb 2007 11:07:47 +0000 Trancer http://www.rec-sec.com/?p=91 MediaWikiSecurity Advisory for MediaWiki versions:
1.6.x branch before 1.6.10
1.7.x branch before 1.7.3
1.8.x branch before 1.8.4
1.9.x branch before 1.9.3

Vulnerabilities found:

  • Cross-Site Scripting
  • UTF-7 Cross-Site Scripting

TXT Format TXT version.

Also on:
BID 21956
MediaWiki patch announcement
RSnake expand the MediaWiki 1.9.2 UTF-7 XSS exploit

]]> http://www.rec-sec.com/2007/02/18/mediawiki-cross-site-scripting-vulnerabilities/feed/ 0