|
Movable Type Multiple Weaknesses and Vulnerabilities
|
|
Secunia Advisory:
|
SA16899
|
|
|
Release Date:
|
2005-09-22
|
|
Last Update:
|
2006-02-03
|
|
Popularity:
|
7,397 views
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Cross Site Scripting
Spoofing
Exposure of system information
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Partial Fix
|
|
| Software: | Movable Type 3.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2005-3101
CVE-2005-3102
CVE-2005-3103
CVE-2005-3104
CVE-2005-4690
|
|
Description:
Tim Brown has reported some vulnerabilities and weaknesses in Movable Type, which can be exploited by malicious users to conduct phishing and script insertion attacks, and potentially compromise a vulnerable system, and by malicious people to disclose certain information.
1) The problem is that different error messages are returned depending on whether or not a supplied username exists when using the password reset functionality. This can be exploited to enumerate valid usernames.
2) The problem is that files with arbitrary file extensions can be uploaded to a directory inside the web root. This can e.g. be exploited to upload and execute a malicious PHP script.
This can further be exploited to upload files to an arbitrary directory by specifying the blog directory path when creating a new blog.
Successful exploitation requires privileges to upload files through the administrative interface.
3) Input passed to certain fields when creating new blog entries isn't properly sanitised before being used. This can be exploited to inject arbitrary script code, which will be executed in a user's browser session in context of an affected site when the malicious user data is viewed.
4) The problem is that the "mt-comments.cgi" script redirects external URLs in comments. This can be exploited to trick users into visiting a malicious web site.
The weaknesses and the vulnerabilities have been reported in version 3.16. Other versions may also be affected.
Solution:
1, 3, 4) Update to version 3.2.
2) Grant only trusted users access to upload files via the administrative interface.
Provided and/or discovered by:
Tim Brown, Portcullis Computer Security Ltd
Changelog:
2005-10-04: Added CVE references.
2006-02-03: Added CVE reference.
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
