[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <5A4D0468-0D68-487A-86B8-B28B04464F7A@surevine.com>
Date: Mon, 30 Mar 2015 12:35:43 +0100
From: Simon Waters <simon.waters@...evine.com>
To: cve-assign@...re.org
Cc: oss-security@...ts.openwall.com
Subject: Re: Insecure file upload in Berta CMS
> On 28 Mar 2015, at 05:47, cve-assign@...re.org wrote:
>
> Signed PGP part
> > http://seclists.org/fulldisclosure/2015/Mar/155
>
> > We found that the file upload didn't require authentication.
> ...
>
> Use CVE-2015-2780 for this "didn't require authentication" issue.
Thanks
> The ability to bypass image validation by using certain .php files
> that begin with a "GIF89" substring might be considered a bug, but is
> perhaps not a security bug.
Your analysis is similar to mine, and private correspondence with the developer.
I've added a comment to PHP docs for getimagesize to remind folks it doesn't validate images, I don't think this is a bug.
It might be a useful feature for PHP to have a simple file upload validation (Image magick has one), but there is no guarantee that valid files won't be misinterpreted as malicious if you can get them interpreted in an inappropriate context.
Download attachment "signature.asc" of type "application/pgp-signature" (496 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
