Vulnerabilities > CVE-2007-6686 - Unspecified vulnerability in Menalto Gallery

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
menalto
critical
nessus

Summary

The URL rewrite module in Menalto Gallery before 2.2.4 allows attackers to include and execute arbitrary local files via unknown vectors related to the admin controller.

Nessus

  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200802-04.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200802-04 (Gallery: Multiple vulnerabilities) The Gallery developement team reported and fixed critical vulnerabilities during an internal audit (CVE-2007-6685, CVE-2007-6686, CVE-2007-6687, CVE-2007-6688, CVE-2007-6689, CVE-2007-6690, CVE-2007-6691, CVE-2007-6692, CVE-2007-6693). Impact : A remote attacker could exploit these vulnerabilities to execute arbitrary code, conduct Cross-Site Scripting and Cross-Site Request Forgery attacks, or disclose sensitive informations. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id31034
    published2008-02-12
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/31034
    titleGLSA-200802-04 : Gallery: Multiple vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 200802-04.
    #
    # The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(31034);
      script_version("1.14");
      script_cvs_date("Date: 2019/08/02 13:32:44");
    
      script_cve_id("CVE-2007-6685", "CVE-2007-6686", "CVE-2007-6687", "CVE-2007-6688", "CVE-2007-6689", "CVE-2007-6690", "CVE-2007-6691", "CVE-2007-6692", "CVE-2007-6693");
      script_xref(name:"GLSA", value:"200802-04");
    
      script_name(english:"GLSA-200802-04 : Gallery: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-200802-04
    (Gallery: Multiple vulnerabilities)
    
        The Gallery developement team reported and fixed critical
        vulnerabilities during an internal audit (CVE-2007-6685, CVE-2007-6686,
        CVE-2007-6687, CVE-2007-6688, CVE-2007-6689, CVE-2007-6690,
        CVE-2007-6691, CVE-2007-6692, CVE-2007-6693).
      
    Impact :
    
        A remote attacker could exploit these vulnerabilities to execute
        arbitrary code, conduct Cross-Site Scripting and Cross-Site Request
        Forgery attacks, or disclose sensitive informations.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/200802-04"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All Gallery users should upgrade to the latest version:
        # emerge --sync
        # emerge --ask --oneshot --verbose '>=www-apps/gallery-2.2.4'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_cwe_id(20, 59, 79, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:gallery");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2008/02/11");
      script_set_attribute(attribute:"plugin_publication_date", value:"2008/02/12");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2008-2019 Tenable Network Security, Inc.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"www-apps/gallery", unaffected:make_list("ge 2.2.4", "lt 2.0"), vulnerable:make_list("lt 2.2.4"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Gallery");
    }
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_4AAB7BCDB29411DCA6F000A0CCE0781E.NASL
    descriptionThe Gallery team reports : Gallery 2.2.4 addresses the following security vulnerabilities : - Publish XP module - Fixed unauthorized album creation and file uploads. - URL rewrite module - Fixed local file inclusion vulnerability in unsecured admin controller and information disclosure in hotlink protection. - Core / add-item modules - Fixed Cross Site Scripting (XSS) vulnerabilities through malicious file names. - Installation (Gallery application) - Update web-accessibility protection of the storage folder for Apache 2.2. - Core (Gallery application) / MIME module - Fixed vulnerability in checks for disallowed file extensions in file uploads. - Gallery Remote module - Added missing permissions checks for some GR commands. - WebDAV module - Fixed Cross Site Scripting (XSS) vulnerability through HTTP PROPPATCH. - WebDAV module - Fixed information (item data) disclosure in a WebDAV view. - Comment module - Fixed information (item data) disclosure in comment views. - Core module (Gallery application) - Improved resilience against item information disclosure attacks. - Slideshow module - Fixed information (item data) disclosure in the slideshow. - Print modules - Fixed information (item data) disclosure in several print modules. - Core / print modules - Fixed arbitrary URL redirection (phishing attacks) in the core module and several print modules. - WebCam module - Fixed proxied request weakness.
    last seen2020-06-01
    modified2020-06-02
    plugin id29796
    published2007-12-26
    reporterThis script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/29796
    titleFreeBSD : gallery2 -- multiple vulnerabilities (4aab7bcd-b294-11dc-a6f0-00a0cce0781e)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2018 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(29796);
      script_version("1.16");
      script_cvs_date("Date: 2019/08/02 13:32:38");
    
      script_cve_id("CVE-2007-6685", "CVE-2007-6686", "CVE-2007-6687", "CVE-2007-6689", "CVE-2007-6690", "CVE-2007-6692");
    
      script_name(english:"FreeBSD : gallery2 -- multiple vulnerabilities (4aab7bcd-b294-11dc-a6f0-00a0cce0781e)");
      script_summary(english:"Checks for updated package in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote FreeBSD host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The Gallery team reports :
    
    Gallery 2.2.4 addresses the following security vulnerabilities :
    
    - Publish XP module - Fixed unauthorized album creation and file
    uploads.
    
    - URL rewrite module - Fixed local file inclusion vulnerability in
    unsecured admin controller and information disclosure in hotlink
    protection.
    
    - Core / add-item modules - Fixed Cross Site Scripting (XSS)
    vulnerabilities through malicious file names.
    
    - Installation (Gallery application) - Update web-accessibility
    protection of the storage folder for Apache 2.2.
    
    - Core (Gallery application) / MIME module - Fixed vulnerability in
    checks for disallowed file extensions in file uploads.
    
    - Gallery Remote module - Added missing permissions checks for some GR
    commands.
    
    - WebDAV module - Fixed Cross Site Scripting (XSS) vulnerability
    through HTTP PROPPATCH.
    
    - WebDAV module - Fixed information (item data) disclosure in a WebDAV
    view.
    
    - Comment module - Fixed information (item data) disclosure in comment
    views.
    
    - Core module (Gallery application) - Improved resilience against item
    information disclosure attacks.
    
    - Slideshow module - Fixed information (item data) disclosure in the
    slideshow.
    
    - Print modules - Fixed information (item data) disclosure in several
    print modules.
    
    - Core / print modules - Fixed arbitrary URL redirection (phishing
    attacks) in the core module and several print modules.
    
    - WebCam module - Fixed proxied request weakness."
      );
      # http://gallery.menalto.com/gallery_2.2.4_released
      script_set_attribute(
        attribute:"see_also",
        value:"http://galleryproject.org/gallery_2.2.4_released"
      );
      # https://vuxml.freebsd.org/freebsd/4aab7bcd-b294-11dc-a6f0-00a0cce0781e.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?755d6dac"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_cwe_id(20, 59, 79, 264);
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:gallery2");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2007/12/24");
      script_set_attribute(attribute:"patch_publication_date", value:"2007/12/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2007/12/26");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"gallery2<2.2.4")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");