0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Symantec Web Gateway 5.2.2 OS Command Injection Vulnerability
Author
Risk
[Security Risk High
]0day-ID
Category
Date add
CVE
Platform
------------------------------------------------------------------------------------
Symantec Web Gateway <= 5.2.2 (new_whitelist.php) OS Command Injection
Vulnerability
------------------------------------------------------------------------------------
[-] Software Link:
https://www.symantec.com/
[-] Affected Versions:
Version 5.1.1.24, 5.2.1.80 and 5.2.2.118. Other versions might be affected.
[-] Vulnerability Description:
The vulnerable code is located in the /spywall/new_whitelist.php script:
141. $isNew = $_POST['isNew'];
142. $sid = $_POST['sid'];
143. $exceptions = array();
144. $last_modified = time();
145. /* validate input */
146.
147. if (!$sid && !isValidWhiteDomain($white_ip) &&
!isIpSubnet($white_ip)) {
148. $errors['white_ip'] = 'Please enter a valid domain or IP
address or IP/mask.';
149. }
The vulnerability exists because the validation checks may be bypassed
by setting the "sid" POST parameter to a
value different from zero. In this way, even though the "white_ip" POST
parameter (assigned to the $white_ip variable)
is not a valid domain or IP address, it will be passed to the
add_whitelist() function as its $url parameter:
329. function add_whitelist ($signature, $url, $whitelist,
$ignore_auth, $restoreConfig = 0) {
330. [...]
331. if (!isCiu()){
332. if ($restoreConfig) {
333. syscall("sudo /usr/local/bin/updateDB 2 1 $url
$whitelist $ignore_auth [...]
334. } else {
335. syscall("sudo /usr/local/bin/updateDB 2 1 $url
$whitelist $ignore_auth [...]
336. }
337. }
This can be exploited to inject and execute arbitrary OS commands with
the privileges of the "root" user on the appliance.
Successful exploitation of this vulnerability requires an user account
with read-write permissions (POLICY_LEVEL).
[-] Solution:
Update to version 5.2.5.
[-] Disclosure Timeline:
[09/07/2016] - Vendor notified
[11/07/2016] - Vendor response
[09/09/2016] - Vendor asks to confirm this is fixed in version 5.2.5
[15/09/2016] - Feedback sent to the vendor
[05/10/2016] - Publication of vendor"s advisory: https://goo.gl/aOJq5A
[06/10/2016] - Publication of this advisory
[-] CVE Reference:
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2016-5313 to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
# 0day.today [2024-07-07] #