[UNIX] SysCP Code Execution

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  SysCP Code Execution
------------------------------------------------------------------------


SUMMARY

" <http://www.syscp.de/> SysCP, the System Control Panel is a server 
administration tool which enables an internet service provider to give 
their customers a web-based application to administrate their email 
addresses, their subdomains etc."

By using global variables, attackers can inject code into SysCP and cause 
it to execute arbitrary code on the system.

DETAILS

Vulnerable Systems:
 * SysCP version 1.2.10 and prior

Immune Systems:
 * SysCP version 1.2.11

With the PHP configuration flag "register_globals On" (which is still the 
case for a large installation base), a number of variables of SysCP can be 
injected, leading to the execution of arbitrary remote code, which can 
also be included from a remote server. This can lead to complete system 
compromise, and setting backdoors, steal information, or change system 
settings.

Disclosure Timeline:
18. July 2005 - Initial vendor contact
23. July 2005 - PoC disclosed to vendor
04. August 2005 - Vendor has released updated version
09. August 2005 - public disclosure


ADDITIONAL INFORMATION

The information has been provided by  
<mailto:christopher.kunz@xxxxxxxxxxxxxxxx> Christopher Kunz.
The original article can be found at:  
<http://www.hardened-php.net/advisory_132005.64.html> 
http://www.hardened-php.net/advisory_132005.64.html



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@xxxxxxxxxxxxxx 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@xxxxxxxxxxxxxx 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.