正文

Gallery远程全局变量注入漏洞

admin
admin V管理员 /0 评论 /10 阅读
1231
此篇文章发布距今已超过1282天，您需要注意文章的内容或图片是否可用！

漏洞信息详情

Gallery远程全局变量注入漏洞

  • CNNVD编号：CNNVD-200412-575
    • <!--
  • 危害等级： 中危-->
  • 危害等级： 中危
  • CVE编号： CVE-2004-2124
  • 漏洞类型： 输入验证
  • 发布时间： 2004-12-31
  • 威胁类型： 远程
  • 更新时间： 2006-09-28
  • 厂        商： gallery_project
  • 漏洞来源： .');">The disclosure of ...

漏洞简介

Gallery 1.3.1至1.4.1版本的register_globals 仿真性能存在漏洞。远程攻击者可以借助GALLERY_BASEDIR参数修改和执行PHP remote file inclusion攻击修改HTTP_POST_VARS变量。该漏洞不同于CVE-2002-1412。

漏洞公告

The vendor has released Gallery 1.4.1-pl1 to address this issue. Users are advised to upgrade to the fixed version. Gentoo has released advisory GLSA 200402-04 dealing with this issue. Please see the reference section for details. The vendor has released Gallery 1.4.2 to address this and other issues. It is advised that if possible, users should upgrade to this version. Bharat Mediratta Gallery 1.3.1

  • Bharat Mediratta Gallery 1.41-pl1 http://sourceforge.net/project/showfiles.php?group_id=7130&package_id= 7239&release_id=212324
Bharat Mediratta Gallery 1.3.2
  • Bharat Mediratta Gallery 1.41-pl1 http://sourceforge.net/project/showfiles.php?group_id=7130&package_id= 7239&release_id=212324
Bharat Mediratta Gallery 1.3.3
  • Bharat Mediratta Gallery 1.41-pl1 http://sourceforge.net/project/showfiles.php?group_id=7130&package_id= 7239&release_id=212324
Bharat Mediratta Gallery 1.4
  • Bharat Mediratta Gallery 1.41-pl1 http://sourceforge.net/project/showfiles.php?group_id=7130&package_id= 7239&release_id=212324
Bharat Mediratta Gallery 1.4.1
  • Bharat Mediratta Gallery 1.41-pl1 http://sourceforge.net/project/showfiles.php?group_id=7130&package_id= 7239&release_id=212324

参考网址

来源: BUGTRAQ 名称: 20040127 Remote exploit in Gallery 1.3.1, 1.3.2, 1.3.3, 1.4 and 1.4.1 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=107524414317693&w=2 来源: gallery.menalto.com 链接:http://gallery.menalto.com/modules.php?op=modload&name=News&file=index 来源: XF 名称: gallery-gallerybasedir-file-include(14950) 链接:http://xforce.iss.net/xforce/xfdb/14950 来源: BID 名称: 9490 链接:http://www.securityfocus.com/bid/9490 来源: GENTOO 名称: GLSA-200402-04 链接:http://www.gentoo.org/security/en/glsa/glsa-200402-04.xml 来源: SECUNIA 名称: 10712 链接:http://secunia.com/advisories/10712/ 来源: OSVDB 名称: 3737 链接:http://www.osvdb.org/3737

受影响实体

  • Gallery_project Gallery:1.4.1  
    <!--
    2000-1-1
    -->
  • Gallery_project Gallery:1.4  
    <!--
    2000-1-1
    -->
  • Gallery_project Gallery:1.3.3  
    <!--
    2000-1-1
    -->
  • Gallery_project Gallery:1.3.2  
    <!--
    2000-1-1
    -->
  • Gallery_project Gallery:1.3.1  
    <!--
    2000-1-1
    -->

补丁

    暂无