0day.today - Dunyanin En Buyuk Exploit Veritabani
![](/img/logo_green.jpg)
Biz sadece bir adet ana domain kullaniyoruz DOMAIN_LINK
Eger exploit satin alacaksaniz ve ya hizmet icin odeme yapacaksaniz, altin almaniz gerekmekte. Biz sitemizi hack amacli kullanmak istemiyoruz, yani her turlu dogru olmayan, kanunsuz ve illegal yapilan eylemler diger hesaplari olumsuz yonde etkileyebilir ve sonrasinda buna yol acan/lar, web sitelerimize ve verilere erisimi tamamen kesilir, banlanir ve hesabini tarafimizca yok edilir.
Sadece bu sitenin yonetimine itibar edin. Sahtelere Dikkat!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
- Oku [ anlasma ]
- Oku [ Gonder ] kurallar
- Ziyaret et [ SSS ] page
- [ Uye Ol ] profil
- [ FIYAT ]
- Eger istiyorsaniz [ satmak ]
- Eger istiyorsaniz [ almak ]
- Eger kaybederseniz [ Hesap ]
- Herhangi bir sorunuz [ [email protected] ]
- Yetkili sayfa
- Uyelik sayfasi
- Hesap sayfasini geri yukle
- SSS sayfasi
- Iletisim sayfasi
- Paylasim kurallari
- Anlasma sayfasi
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Bize ulasabilirsiniz:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Symantec Web Gateway 5.2.2 OS Command Injection Vulnerability
Yazar
Risk
![](/img/risk/critlow_3.gif)
Security Risk High
]0day-ID
Kategori
Eklenme Tarihi
CVE
Platform
------------------------------------------------------------------------------------ Symantec Web Gateway <= 5.2.2 (new_whitelist.php) OS Command Injection Vulnerability ------------------------------------------------------------------------------------ [-] Software Link: https://www.symantec.com/ [-] Affected Versions: Version 5.1.1.24, 5.2.1.80 and 5.2.2.118. Other versions might be affected. [-] Vulnerability Description: The vulnerable code is located in the /spywall/new_whitelist.php script: 141. $isNew = $_POST['isNew']; 142. $sid = $_POST['sid']; 143. $exceptions = array(); 144. $last_modified = time(); 145. /* validate input */ 146. 147. if (!$sid && !isValidWhiteDomain($white_ip) && !isIpSubnet($white_ip)) { 148. $errors['white_ip'] = 'Please enter a valid domain or IP address or IP/mask.'; 149. } The vulnerability exists because the validation checks may be bypassed by setting the "sid" POST parameter to a value different from zero. In this way, even though the "white_ip" POST parameter (assigned to the $white_ip variable) is not a valid domain or IP address, it will be passed to the add_whitelist() function as its $url parameter: 329. function add_whitelist ($signature, $url, $whitelist, $ignore_auth, $restoreConfig = 0) { 330. [...] 331. if (!isCiu()){ 332. if ($restoreConfig) { 333. syscall("sudo /usr/local/bin/updateDB 2 1 $url $whitelist $ignore_auth [...] 334. } else { 335. syscall("sudo /usr/local/bin/updateDB 2 1 $url $whitelist $ignore_auth [...] 336. } 337. } This can be exploited to inject and execute arbitrary OS commands with the privileges of the "root" user on the appliance. Successful exploitation of this vulnerability requires an user account with read-write permissions (POLICY_LEVEL). [-] Solution: Update to version 5.2.5. [-] Disclosure Timeline: [09/07/2016] - Vendor notified [11/07/2016] - Vendor response [09/09/2016] - Vendor asks to confirm this is fixed in version 5.2.5 [15/09/2016] - Feedback sent to the vendor [05/10/2016] - Publication of vendor"s advisory: https://goo.gl/aOJq5A [06/10/2016] - Publication of this advisory [-] CVE Reference: The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2016-5313 to this vulnerability. [-] Credits: Vulnerability discovered by Egidio Romano. # 0day.today [2024-07-16] #