Posts

Showing posts from October, 2011

zFtp Server <= 2011-04-13 | "STAT,CWD" Remote Denial of Service Vulnerability

1. OVERVIEW

The zFTP server is found to be vulnerable to denial of service in handling STAT and CWD commands with overly large buffer requests.


2. BACKGROUND

The zFTP server is a Windows based FTP server with focus on clever Active Directory integration and powerful, effortless administration.


3. VERSIONS AFFECTED

2011-04-13 and earlier


4. PROOF-OF-CONCEPT/EXPLOIT

http://www.exploit-db.com/exploits/18028/


5. SOLUTION

The vendor has released the patched version (http://download.zftpserver.com/zFTPServer_Suite_Setup.exe)


6. VENDOR

Vastgota-Data


7. CREDIT

This vulnerability was discovered by Myo Soe, http://yehg.net, YGN Ethical Hacker Group, Myanmar.


8. DISCLOSURE TIME-LINE

2011-06-19: notified vendor through email
2011-10-17: vendor released fixed version, 2011-10-17
2011-10-25: vulnerability disclosed


9. REFERENCES

Original Advisory URL: http://core.yehg.net/lab/pr0js/advisories/[zftpserver_2011-04-13]_stat,cwd_dos
zFTP Server Home Page: http://zftpserver.com


#yehg [2011-10-25]

vTiger CRM 5.2.x | PHP Version Disclosure

How do attackers try to know PHP version if the server has disabled "X-Powered-By" header (i.e expose_php = Off)? 

The vTiger CRM has a flaw that allows attackers to know exact PHP version without authentication.

 Attacker can know it by simply visiting the following url without authentication.

 /phpversionfail.php

 The message shows:
"PHP 5.0.x or above is required. Your current PHP version is 5.3
Kindly upgrade the PHP installation, any try again! "

Version Affected:

Tested on vTiger CRM 5.2.1

vTiger CRM 5.2.x <= Blind SQL Injection Vulnerability

1. OVERVIEW The vTiger CRM 5.2.1 and lower versions are vulnerable to Blind SQL Injection. No fixed version has been released as of 2011-10-05. 2. BACKGROUND vtiger CRM is a free, full-featured, 100% Open Source CRM software ideal for small and medium businesses, with low-cost product support available to production users that need reliable support. vtiger CRM is a widely used product with thousands of users in dozens of countries. It has a vibrant community of users driving the product forward, and contributing to it's development. Over 2 million copies of vtiger CRM have been downloaded so far. It was launched as a fork of version 1.0 of the SugarCRM project launched on December 31st, 2004. 3. VULNERABILITY DESCRIPTION The "onlyforuser" parameter was not properly sanitized, which allows attacker to conduct Blind SQL Injection Attack. This could an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosu…

vTiger CRM 5.2.x <= Remote Code Execution Vulnerability

1. OVERVIEW The vTiger CRM 5.2.1 and lower versions are vulnerable to Remote Code Execution. No fixed version has been released as of 2011-10-05. 2. BACKGROUND vtiger CRM is a free, full-featured, 100% Open Source CRM software ideal for small and medium businesses, with low-cost product support available to production users that need reliable support. vtiger CRM is a widely used product with thousands of users in dozens of countries. It has a vibrant community of users driving the product forward, and contributing to it's development. Over 2 million copies of vtiger CRM have been downloaded so far. It was launched as a fork of version 1.0 of the SugarCRM project launched on December 31st, 2004. 3. VULNERABILITY DESCRIPTION vTiger uses the vulnerable version of phpmailer class file located at /cron/class.phpmailer.php . 4. VERSIONS AFFECTED Tested on 5.2.1 5. PROOF-OF-CONCEPT/EXPLOIT File: /cron/class.phpmailer.php [code] 391: function SendmailSend($header, $bo…

vTiger CRM 5.2.x <= Multiple Cross Site Scripting Vulnerabilities

1. OVERVIEW The vTiger CRM 5.2.1 and lower versions are vulnerable to Cross Site Scripting. No fixed version has been released as of 2011-10-04. 2. BACKGROUND vtiger CRM is a free, full-featured, 100% Open Source CRM software ideal for small and medium businesses, with low-cost product support available to production users that need reliable support. vtiger CRM is a widely used product with thousands of users in dozens of countries. It has a vibrant community of users driving the product forward, and contributing to it's development. Over 2 million copies of vtiger CRM have been downloaded so far. It was launched as a fork of version 1.0 of the SugarCRM project launched on December 31st, 2004. 3. VULNERABILITY DESCRIPTION Multiple parameters were not properly sanitized, which allows attacker to conduct Cross Site Scripting attack. This may allow an attacker to create a specially crafted URL that would execute arbitrary script code in a victim's browser. 4. VERSIONS…