Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » Gallery v1.3.2 allows remote exploit (fixed in 1.3.3)

Gallery v1.3.2 allows remote exploit (fixed in 1.3.3)

by Nikola Strahija on December 28th, 2002 Gallery is an open source image management system. Learn more about it at http://gallery.sourceforge.net


Gallery v1.3.2 introduced a new feature that allows users to publish
images to their website-based Gallery using the Windows XP Publishing
subsystem. This feature introduced a bug that can allow a malicious
user to craft a URL such that they can get remote access to web
server, as the user running the web server.

Many thanks to Michael Graff for noticing this hole and bringing it to
the attention of the Gallery dev team. It's nice to see folks doing
the right thing with dangerous information.

_________________
VERSIONS AFFECTED

The only affected official release is Gallery 1.3.2. However, for
those of you tracking Gallery in CVS, this hole was introduced in
Gallery 1.3.2-cvs-b27 and was closed in Gallery 1.3.3-cvs-b6.

_____
PATCH

The fix to this problem is very simple. Pursue one of the following
three options:

1. Upgrade to v1.3.3, available now on the Gallery website:
http://gallery.sourceforge.net/download.php

-- or --

2. Edit your publish_xp_docs.php and near the top of the file, modify
the code so that this line:



appears after this block:

// Hack prevention.
if (!empty($HTTP_GET_VARS["GALLERY_BASEDIR"]) ||
!empty($HTTP_POST_VARS["GALLERY_BASEDIR"]) ||
!empty($HTTP_COOKIE_VARS["GALLERY_BASEDIR"])) {
print "Security violationn";
exit;
}
?>

-- or --

3. Delete publish_xp_docs.php. This will secure your system but will
also disable the Windows XP Publishing feature.

regards,
Bharat Mediratta
Gallery developer


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »