|
|
PHPProjekt文件可读漏洞
发布时间：2002-04-28
更新时间：2002-04-28
严重程度：中
威胁程度：服务器信息泄露
错误类型：输入验证错误
利用方式：服务器模式
BUGTRAQ ID：4597
受影响系统PHPProjekt PHPProjekt 2.0
- Debian Linux 2.2
- FreeBSD FreeBSD 3.5.1
- FreeBSD FreeBSD 4.2
- HP HP-UX 10.20
- HP HP-UX 11.0
- HP HP-UX 11.11
- MandrakeSoft Linux Mandrake 7.1
- MandrakeSoft Linux Mandrake 7.2
- MandrakeSoft Linux Mandrake 8.0
- Microsoft Windows 2000 Workstation
- Microsoft Windows NT 4.0
- OpenBSD OpenBSD 2.7
- OpenBSD OpenBSD 2.8
- OpenBSD OpenBSD 2.9
- RedHat Linux 6.2
- RedHat Linux 7.0
- RedHat Linux 7.1
- S.u.S.E. Linux 7.0
- S.u.S.E. Linux 7.1
- Sun Solaris 2.6
- Sun Solaris 7.0
- Sun Solaris 8.0
PHPProjekt PHPProjekt 2.0.1
- Debian Linux 2.2
- FreeBSD FreeBSD 3.5.1
- FreeBSD FreeBSD 4.2
- HP HP-UX 10.20
- HP HP-UX 11.0
- HP HP-UX 11.11
- MandrakeSoft Linux Mandrake 7.1
- MandrakeSoft Linux Mandrake 7.2
- MandrakeSoft Linux Mandrake 8.0
- Microsoft Windows 2000 Workstation
- Microsoft Windows NT 4.0
- OpenBSD OpenBSD 2.7
- OpenBSD OpenBSD 2.8
- OpenBSD OpenBSD 2.9
- RedHat Linux 6.2
- RedHat Linux 7.0
- RedHat Linux 7.1
- S.u.S.E. Linux 7.0
- S.u.S.E. Linux 7.1
- Sun Solaris 2.6
- Sun Solaris 7.0
- Sun Solaris 8.0
PHPProjekt PHPProjekt 2.1 a
- Debian Linux 2.2
- FreeBSD FreeBSD 3.5.1
- FreeBSD FreeBSD 4.2
- HP HP-UX 10.20
- HP HP-UX 11.0
- HP HP-UX 11.11
- MandrakeSoft Linux Mandrake 7.1
- MandrakeSoft Linux Mandrake 7.2
- MandrakeSoft Linux Mandrake 8.0
- Microsoft Windows 2000 Workstation
- Microsoft Windows NT 4.0
- OpenBSD OpenBSD 2.7
- OpenBSD OpenBSD 2.8
- OpenBSD OpenBSD 2.9
- RedHat Linux 6.2
- RedHat Linux 7.0
- RedHat Linux 7.1
- S.u.S.E. Linux 7.0
- S.u.S.E. Linux 7.1
- Sun Solaris 2.6
- Sun Solaris 7.0
- Sun Solaris 8.0
PHPProjekt PHPProjekt 2.1
- Debian Linux 2.2
- FreeBSD FreeBSD 3.5.1
- FreeBSD FreeBSD 4.2
- HP HP-UX 10.20
- HP HP-UX 11.0
- HP HP-UX 11.11
- MandrakeSoft Linux Mandrake 7.1
- MandrakeSoft Linux Mandrake 7.2
- MandrakeSoft Linux Mandrake 8.0
- Microsoft Windows 2000 Workstation
- Microsoft Windows NT 4.0
- OpenBSD OpenBSD 2.7
- OpenBSD OpenBSD 2.8
- OpenBSD OpenBSD 2.9
- RedHat Linux 6.2
- RedHat Linux 7.0
- RedHat Linux 7.1
- S.u.S.E. Linux 7.0
- S.u.S.E. Linux 7.1
- Sun Solaris 2.6
- Sun Solaris 7.0
- Sun Solaris 8.0
PHPProjekt PHPProjekt 2.2
- Debian Linux 2.2
- FreeBSD FreeBSD 3.5.1
- FreeBSD FreeBSD 4.2
- HP HP-UX 10.20
- HP HP-UX 11.0
- HP HP-UX 11.11
- MandrakeSoft Linux Mandrake 7.1
- MandrakeSoft Linux Mandrake 7.2
- MandrakeSoft Linux Mandrake 8.0
- Microsoft Windows 2000 Workstation
- Microsoft Windows NT 4.0
- OpenBSD OpenBSD 2.7
- OpenBSD OpenBSD 2.8
- OpenBSD OpenBSD 2.9
- RedHat Linux 6.2
- RedHat Linux 7.0
- RedHat Linux 7.1
- S.u.S.E. Linux 7.0
- S.u.S.E. Linux 7.1
- Sun Solaris 2.6
- Sun Solaris 7.0
- Sun Solaris 8.0
PHPProjekt PHPProjekt 2.3
- Debian Linux 2.2
- FreeBSD FreeBSD 3.5.1
- FreeBSD FreeBSD 4.2
- HP HP-UX 10.20
- HP HP-UX 11.0
- HP HP-UX 11.11
- MandrakeSoft Linux Mandrake 7.1
- MandrakeSoft Linux Mandrake 7.2
- MandrakeSoft Linux Mandrake 8.0
- Microsoft Windows 2000 Workstation
- Microsoft Windows NT 4.0
- OpenBSD OpenBSD 2.7
- OpenBSD OpenBSD 2.8
- OpenBSD OpenBSD 2.9
- RedHat Linux 6.2
- RedHat Linux 7.0
- RedHat Linux 7.1
- S.u.S.E. Linux 7.0
- S.u.S.E. Linux 7.1
- Sun Solaris 2.6
- Sun Solaris 7.0
- Sun Solaris 8.0
PHPProjekt PHPProjekt 2.4 a
- Debian Linux 2.2
- FreeBSD FreeBSD 3.5.1
- FreeBSD FreeBSD 4.2
- HP HP-UX 10.20
- HP HP-UX 11.0
- HP HP-UX 11.11
- MandrakeSoft Linux Mandrake 7.1
- MandrakeSoft Linux Mandrake 7.2
- MandrakeSoft Linux Mandrake 8.0
- Microsoft Windows 2000 Workstation
- Microsoft Windows NT 4.0
- OpenBSD OpenBSD 2.7
- OpenBSD OpenBSD 2.8
- OpenBSD OpenBSD 2.9
- RedHat Linux 6.2
- RedHat Linux 7.0
- RedHat Linux 7.1
- S.u.S.E. Linux 7.0
- S.u.S.E. Linux 7.1
- Sun Solaris 2.6
- Sun Solaris 7.0
- Sun Solaris 8.0
PHPProjekt PHPProjekt 2.4
- Debian Linux 2.2
- FreeBSD FreeBSD 3.5.1
- FreeBSD FreeBSD 4.2
- HP HP-UX 10.20
- HP HP-UX 11.0
- HP HP-UX 11.11
- MandrakeSoft Linux Mandrake 7.1
- MandrakeSoft Linux Mandrake 7.2
- MandrakeSoft Linux Mandrake 8.0
- Microsoft Windows 2000 Workstation
- Microsoft Windows NT 4.0
- OpenBSD OpenBSD 2.7
- OpenBSD OpenBSD 2.8
- OpenBSD OpenBSD 2.9
- RedHat Linux 6.2
- RedHat Linux 7.0
- RedHat Linux 7.1
- S.u.S.E. Linux 7.0
- S.u.S.E. Linux 7.1
- Sun Solaris 2.6
- Sun Solaris 7.0
- Sun Solaris 8.0
PHPProjekt PHPProjekt 3.0
- Apache Software Foundation Apache 1.3.19
- Apache Software Foundation Apache 1.3.19 win32
- Apache Software Foundation Apache 1.3.20
- Apache Software Foundation Apache 1.3.20 win32
- Apache Software Foundation Apache 1.3.22
- Apache Software Foundation Apache 1.3.22 win32
- Apache Software Foundation Apache 1.3.23
- Apache Software Foundation Apache 1.3.23 win32
- Apache Software Foundation Apache 1.3.24
- Apache Software Foundation Apache 1.3.24 win32
PHPProjekt PHPProjekt 3.1 a
PHPProjekt PHPProjekt 3.1 详细描述
PHPProjekt是免费开放源代码的PHP组件。可以运行在多种操作系统下。
攻击者可以伪造upload函数来读取本地主机上文件。问题存在于对相关于upload函数变量的检查不够充分。
测试代码
尚无
解决方案
升级程序：
PHPProjekt PHPProjekt 2.0:
PHPProjekt Upgrade PHPProjekt 3.2
http://www.phprojekt.com/modules.php?op=modload&name=Downloads&file=index&req=viewdownload&cid=1
PHPProjekt PHPProjekt 2.0.1:
PHPProjekt Upgrade PHPProjekt 3.2
http://www.phprojekt.com/modules.php?op=modload&name=Downloads&file=index&req=viewdownload&cid=1
PHPProjekt PHPProjekt 2.1 a:
PHPProjekt Upgrade PHPProjekt 3.2
http://www.phprojekt.com/modules.php?op=modload&name=Downloads&file=index&req=viewdownload&cid=1
PHPProjekt PHPProjekt 2.1:
PHPProjekt Upgrade PHPProjekt 3.2
http://www.phprojekt.com/modules.php?op=modload&name=Downloads&file=index&req=viewdownload&cid=1
PHPProjekt PHPProjekt 2.2:
PHPProjekt Upgrade PHPProjekt 3.2
http://www.phprojekt.com/modules.php?op=modload&name=Downloads&file=index&req=viewdownload&cid=1
PHPProjekt PHPProjekt 2.3:
PHPProjekt Upgrade PHPProjekt 3.2
http://www.phprojekt.com/modules.php?op=modload&name=Downloads&file=index&req=viewdownload&cid=1
PHPProjekt PHPProjekt 2.4 a:
PHPProjekt Upgrade PHPProjekt 3.2
http://www.phprojekt.com/modules.php?op=modload&name=Downloads&file=index&req=viewdownload&cid=1
PHPProjekt PHPProjekt 2.4:
PHPProjekt Upgrade PHPProjekt 3.2
http://www.phprojekt.com/modules.php?op=modload&name=Downloads&file=index&req=viewdownload&cid=1
PHPProjekt PHPProjekt 3.0:
PHPProjekt Upgrade PHPProjekt 3.2
http://www.phprojekt.com/modules.php?op=modload&name=Downloads&file=index&req=viewdownload&cid=1
PHPProjekt PHPProjekt 3.1 a:
PHPProjekt Upgrade PHPProjekt 3.2
http://www.phprojekt.com/modules.php?op=modload&name=Downloads&file=index&req=viewdownload&cid=1
PHPProjekt PHPProjekt 3.1:
PHPProjekt Upgrade PHPProjekt 3.2
http://www.phprojekt.com/modules.php?op=modload&name=Downloads&file=index&req=viewdownload&cid=1
相关信息
Ulf Harnhammar <ulfh@update.uu.se>
参考：http://online.securityfocus.com/archive/1/269407
相关主页:http://www.phprojekt.com/
|
