|
HylaFAX Authentication Bypass and Command Insertion Vulnerabilities
|
|
Secunia Advisory:
|
SA18314
|
|
|
Release Date:
|
2006-01-06
|
|
Popularity:
|
5,961 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
Security Bypass
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | HylaFAX 4.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2005-3538
CVE-2005-3539
|
|
Description:
Some vulnerabilities have been reported HylaFAX, which can be exploited by malicious people to bypass certain security restrictions and by malicious users to compromise a vulnerable system.
1) An unspecified error exists in "hfaxd" when compiled with PAM support disabled. This may be exploited to login using any password.
The vulnerability has been reported in version 4.2.3.
2) The "notify" script does not properly sanitise user's input before using it. This can be exploited by malicious users to execute arbitrary commands on a vulnerable system.
Successful exploitation requires that the malicious user is able to submit faxes to the server.
The vulnerability has been reported in versions 4.2.0 through 4.2.3.
3) The "faxrcvd" script does not properly sanitise user's input before using it. This can be exploited by malicious users to execute arbitrary commands on a vulnerable system.
Successful exploitation requires that CallID (CIDName/CIDNumber) is configured on the server and the attacker is able to submit non alphanumeric characters as CallID data to the server.
The vulnerability has been reported in version 4.2.2 and 4.2.3.
Solution:
Update to version 4.2.4.
ftp://ftp.hylafax.org/source/hylafax-4.2.4.tar.gz
Provided and/or discovered by:
1) Dileep
2-3) Patrice Fournier, iFAX Solutions, Inc.
Original Advisory:
http://www.hylafax.org/content/HylaFAX_4.2.4_release
http://bugs.hylafax.org/bugzilla/show_bug.cgi?id=682
http://bugs.hylafax.org/bugzilla/show_bug.cgi?id=719
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
