[UNIX] SysCP Code Execution

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

SysCP Code Execution
------------------------------------------------------------------------

SUMMARY

" <http://www.syscp.de/> SysCP, the System Control Panel is a server
administration tool which enables an internet service provider to give
their customers a web-based application to administrate their email
addresses, their subdomains etc."

By using global variables, attackers can inject code into SysCP and cause
it to execute arbitrary code on the system.

DETAILS

Vulnerable Systems:
* SysCP version 1.2.10 and prior

Immune Systems:
* SysCP version 1.2.11

With the PHP configuration flag "register_globals On" (which is still the
case for a large installation base), a number of variables of SysCP can be
injected, leading to the execution of arbitrary remote code, which can
also be included from a remote server. This can lead to complete system
compromise, and setting backdoors, steal information, or change system
settings.

Disclosure Timeline:
18. July 2005 - Initial vendor contact
23. July 2005 - PoC disclosed to vendor
04. August 2005 - Vendor has released updated version
09. August 2005 - public disclosure

ADDITIONAL INFORMATION

The information has been provided by
<mailto:christopher.kunz@hardened-php.net> Christopher Kunz.
The original article can be found at:
<http://www.hardened-php.net/advisory_132005.64.html>
http://www.hardened-php.net/advisory_132005.64.html

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.