<<< Date Index >>>     <<< Thread Index >>>

Re: Squirrelmail local file inclusion

--On June 1, 2006 12:50:15 AM +0000 brokejunker@xxxxxxxxx wrote:


Squirrelmail local file inclusion bug in functions/plugin.php .
Tested on the latest 1.4.x version.
No authentication needed.

if (isset($plugins) && is_array($plugins)) {
    foreach ($plugins as $name) {
        use_plugin($name);
    }
...
function use_plugin ($name) {
    if (file_exists(SM_PATH . "plugins/$name/setup.php")) {
        include_once(SM_PATH . "plugins/$name/setup.php");
        $function = "squirrelmail_plugin_init_$name";
        if (function_exists($function)) {
            $function();
        }
    }
}
....

If register_globals is on we can control the $name variable.
This is the second "bug" I've seen in the past week that requires register_globals to be on. Yet register_globals has been off by default for the past four years. <http://us2.php.net/ChangeLog-4.php#4.2.0>
The developers of PHP specifically address its use and warn against it unless you know what you're doing. <http://us2.php.net/register_globals>
Squirrelmail even warns specifically against using register_globals = on and checks for it when installing. 

grep register_globals /usr/local/share/doc/squirrelmail/*
/usr/local/share/doc/squirrelmail/ChangeLog: - Added PHP register_globals check to configuration test utility. /usr/local/share/doc/squirrelmail/ChangeLog: - Fixed use of squirrelmail_language cookie with PHP register_globals = /usr/local/share/doc/squirrelmail/ChangeLog: - Prefs caching didn't work properly with register_globals off (#995102). 
/usr/local/share/doc/squirrelmail/ChangeLog:    by register_globals = off.
/usr/local/share/doc/squirrelmail/ChangeLog: - This release is compatible with installations that have register_globals set to off. /usr/local/share/doc/squirrelmail/INSTALL: It is highly advised to NOT turn on register_globals, as this can lead /usr/local/share/doc/squirrelmail/INSTALL: to security holes. If you must use register_globals for some applications, /usr/local/share/doc/squirrelmail/security.txt:- PHP configuration. It's very important to turn register_globals OFF. /usr/local/share/doc/squirrelmail/security.txt: could only be exploited when register_globals was set to on. If you /usr/local/share/doc/squirrelmail/security.txt: need register_globals for other web applications, turn it on specifically
Yet know we're getting "security advisories" warning, hey, if you change the defaults and ignore all the warnings, you too can write insecure code! 

Is human stupidity a software bug?

Paul Schmehl (pauls@xxxxxxxxxxxx)
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/

Attachment: p7si9yYvDgVsB.p7s
Description: S/MIME cryptographic signature