|
Claroline File Inclusion Vulnerabilities
|
|
|
|
|
Secunia Advisory:
|
SA20003
|
|
|
Release Date:
|
2006-05-08
|
|
Last Update:
|
2006-05-11
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Claroline 1.x
|
| | CVE reference: | CVE-2006-2284 (Secunia mirror)
CVE-2006-2285 (Secunia mirror)
CVE-2006-2286 (Secunia mirror)
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Description:
Some vulnerabilities have been discovered in Claroline, which can be exploited by malicious people to compromise a vulnerable system.
Input passed to the "clarolineRepositorySys" and "includePath" parameters in various scripts in the "claroline/auth/extauth/drivers/" directory, the "claro_CasLibPath" parameter in "claroline/auth/extauth/casProcess.inc.php", the "includePath" parameter in "claroline/inc/lib/event/init_event_manager.inc.php", and the "rootSys" and "clarolineRepositoryAppend" parameters in "claroline/inc/lib/export_exe_tracking.class.php" isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from external and local resources.
Successful exploitation requires that "register_globals" is enabled.
The vulnerabilities have been confirmed in version 1.7.5 and also reported in version 1.6.4. Prior versions may also be affected.
Solution:
Apply patches.
Claroline 1.7.5:
http://www.claroline.net/dlarea/claroline.patch17501.zip
Claroline 1.6.4:
http://www.claroline.net/dlarea/claroline.patch16401.zip
Provided and/or discovered by:
beford
Additional information provided by Kevin Fernandez.
Changelog:
2006-05-09: Kevin Fernandez reports about additional affected scripts. Updated "Description" and "Solution" sections.
2006-05-10: Updated "Solution Status" and "Solution" sections.
2006-05-11: Added CVE references.
2006-05-11: Added CVE reference.
Original Advisory:
http://milw0rm.com/exploits/1766
http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045895.html
Claroline.net:
http://www.claroline.net/news.php
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
13 Related Secunia Security Advisories, displaying 10
|
|
|
1. Claroline Multiple Cross-Site Scripting Vulnerabilities
|
|
2. Claroline Multiple Cross-Site Scripting and Request Forgery Vulnerabilities
|
|
3. Claroline Multiple Vulnerabilities
|
|
4. Claroline Multiple Vulnerabilities
|
|
5. Claroline "$_SERVER['PHP_SELF']" Cross-Site Scripting Vulnerability
|
|
6. Claroline "includePath" File Inclusion Vulnerability
|
|
7. Claroline "extAuthSource['newUser']" File Inclusion Vulnerability
|
|
8. Claroline Unspecified Cross-Site Scripting Vulnerability
|
|
9. Claroline Two File Inclusion Vulnerabilities
|
|
10. Claroline Multiple Vulnerabilities
|
Show all related advisories
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
