[LWN Logo]
[Timeline]
Date:         Fri, 27 Oct 2000 17:10:54 +0200
From: "Morpheus[bd]" <morpheusbd@GMX.NET>
Subject:      CGI-Bug: News Update 1.1 administration password bug
To: BUGTRAQ@SECURITYFOCUS.COM

This is a multi-part message in MIME format.

------=_NextPart_000_000B_01C04038.DDACA7C0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

Hi,

there is a vulnerability in News Update 1.1 ((c) by CGIScriptCenter) which
allows malicious user to change the news administration password without
knowing the correct (former)password. For further information take a look at
the attached package, including an advisory and a proof-of-concept exploit.

Ciao,
Morpheus[bd]
www: www.brightdarkness.de
mailto: morpheusbd@gmx.net

------=_NextPart_000_000B_01C04038.DDACA7C0
Content-Type: application/x-gzip;
	name="newsexp.tar.gz"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
	filename="newsexp.tar.gz"

H4sICF7s9jkAA25ld3NleHAudGFyAO07a3fbNrL9Kv4KVNsmkq23E7cr2dm1YznRWcf2teSm9zg+
PhQJSrymSC4BWlFS/9b7R/rhzgzAlyS7Sa5372OF00YkMBgM5j0g7PO54B/D5nf/wNZqvWj99PIl
/FJb/lXPP7UBZHe33YHndruz2/mOvfxHEpW0WEgzYuy7KAjkY3B/NP5/tPla/vh7Aw8N6+nXaLVb
rd0XLx6Qf2fnp93dRP4vf9oFuPbOTmv3O9Z6elJW27+4/JtbT9cM9mDL1IuxOmM2F1bkhtIN/Ecm
QauvNpow5hPXXwbusqEp2ZklWafNOqBaBGoF4SJyJ1NZBK28rhIMGy/YuyAKpzwWV2P7mubwmel6
q+hnGm5s/3Uy+9jwuTQIvP8x9AJXwlI2Z04QMTnl7BS2zC5D25SctRvttescAywg5cz1YdrMRIYw
wTmbLZhp37kiiBZsPnWtKRPTIPZs2DjAAn5XsAYobmPyiRCFpnVrTnhD0fM6mIWu5/qT5onr38Jv
l00si3FFJsigHiQvBH8pYG6XzV3PwwXCyPUlt2Fh7tNWNCyDRdFaaMyVQJBkZjSJZ9yXAlZ+QlVq
GsY/RzOvjlxheaY749E1Mm8oTd82I5vZaT8zw9BzuWBTHvEGOwqYH0gWC67EEEbBJDJnDTbKvQEm
eAl8b0H6wO3YIuGaHgvjKAwEFw1gOwhTAhRbBHGEv5Erbhv/uxm59ai9fk3TyPJsQ6Y5Eei/CBw5
NyPeQ9YwywTWcJCIjNxxLIlrIKYmWY/tOosUGQzEvs2VBUoezUAIDr28Ob1kb7jPIxDBeTz2XIud
uBb3QQYmrI89YgqKPc6Q4bRjpGaoqQF7BewkyB7jYAGw0B2PBFptJ1lIY60xoC63zQq4JiVmcntV
2MCCeeAcUhSNL+fZ0wng6Rpo2p9c3/Ji8IF7Qtpu0Ji+KnSBW5kU+yy5CPkymO2542IfOFp7qUss
RFME1i2Xq/2IVKxgcOH/pusX+80oNJs4UuzmUeQvke9YvvSW1nInYNBrEPrmjAseraFYmrSS8Seb
O7BsqVR63x8Mh6VSIhPyvU6l/KG1s3PV6nX+PCtXE+gVAV6cjdYKtoCk3dtpr0NSenNx2T/9gtmd
3OyM0Df9k8MvWXunMLt0eHJw+cBuAfhFEfhkcHLwMPDLtbt62z85WceX5dm7ODud/u7g18PL4+P+
hYZ+0frz7nrPyQ4uh28ODoFzjxhCE8AkeYNZgNGRcbDxBYQLf5JG2XnkSokBNiDA4ejo7HLEyIw0
Uf1fz0/OBqObwenxWanUYYB14JBDpMAyNwFxknpgAgEpQaPBrKnpT8hFAuY2+kl21D+8fKNeAX/C
X+p9FPkRH8eTVdQpuk6eXIUPpNb51pCjGJdE4Pq5Y9qYKRYyKZU3ivw+Tvvvh5fnRwej/s35weht
qdy0Jm597PpNO57NFlTaxGGZkJ+CZX4pzhuFtFRWCBqhp3AcQbyY8PnvvrCmMPvcFGIeRJI5v0eQ
NRQTP0jwZnm85++PSqVykkcqfG9Ho/P6Bf97zMWXIckRd4MIy+dnwxH7URCmZrvR+hB98MvsgwHC
KL8NhOzCYL7vgjvg4Xi03P868H1uYXjqstceJCn5QchWovrBBLR5edqBZfEQereaW0vYQL9lHd1x
VyVRKglqfqzP5/N6HHncx5TZXjcLxiZyCksVRvPP4dze/1E8g58O/gousWd7e8jlthaKvb29Mpt4
3ockmoNimxbG8IIE4hmOgJYD6112FxAgn7H3fFwf8ggMmX2KmTBjYEVOKmw4eHd+0r+56P/bZX84
KpXf9L9KJpq2BNvhxdn7YeqOGCtT7eDWD6MACvaIVX5tt3vssgfphh9/ZJ3GC+bu/rxbBRRCuJ/4
jSQHw/0KuD3m2DUoTnzY3V3g2mzrLpRRjWk4v4ocGZm3sB8nCmbs8nTwKyigBAbesnOVmc3QddXZ
L4HXYANMkt43Lhpgq+DYfLIcxj5Tlp0g9bgje6on6dIer6fLMiQHPErEtoCanqpc4IntszvqwHdC
Az16EpRCHq+ozlesVdVrQt7nsAqrJCvABNp8BfdNW6Up1Srb28/PUvMo2LP9fdYfnI4uqrlaIYev
1Uv7uSd4DijiMo58Vqm3qwnMvf5VhNb3l7autrm93K1mJeh8wnYP4oScAZLVhIuzxU3ETTsTa8LB
J5HiZ6Ok1wP8JVzoBvIetf9kBFcsbdEYyanQT93j2LnCCHoNUi0hi1NECf/Nien6XVB8JbjcQrQ5
3FiCSelp4FSSjirKUaHB5GCdCFXSMAkgRtFKPTQxxVklp1LpnuTICtTtI3U50BZBJjvVxCEJ0A2S
SflTr0PHlgJJGbO93TMSRLjkfWaZCALlOU+FuMYqZ+ZHcIFPJVSUZskHplpAFAnKqiV2V8obXQnL
1QpqPLgXH/is6IDn7W3FcS0xC0ASXcQtPLNALMDAtoIidmxvA5BFzMdZFo4//+A/Jx6XxjD3tleC
DUKARXao84UAKr0a89xbzpwJl6JSxT0UBWYpUamVsMdXSxPeTHiIu392DOYfMIikJjFeYSuRFefI
SGFFgCkCQs8h0Gcz1PpLikTTQPsCEJxSQghDKAPii6IcNUUrR0ttN4YMEItT18fwvrJVjd9XSkMp
Efc8SXnBLzyCzMaOQeSfIFJR5DrH7AOTGhWe6KACEaF2TaUMb6w0rlfIXUwh/ly1W63raua2ZRRb
kmFJZdp2dAPxUZi9/BBOwlR2axpqZ434cYJj99L3EGnZZz+3NIwahx5VrFUOjiHj7I9qbHj2+m83
w9FF/+BdjbW06xx/4lFQeSbM1OiFWdVjwmwI179xzJkL+ek+05gKg3r1qYTgUsEXPVfprAbC/TUE
/QAsFn/0XMENKh0GyWpHXYwUrDINYUplmSNVyAclvo0XWPrlMJ1enpzkI8rn3DPVb71CR0iqVCkX
0HXL1SIUlYzFrjVBKB+IGJvxmRUukLXLPKhNw/qrqXrUTM96qrmYlnJSq1NFybaW8iNRHmTIsgzJ
Y68wtcCAZPM6Cy1s28JsVC+Y617ixIOhWA9kygq7oTRQVU8c6gxzXU2Ah0nwOPV4/J8S80BwVZAk
Jjm/TV3a0uiIO6bZN/rAVFnbFooyDdSmnGZWh/Nc9Au1zFB0pkHg1sy+SkvT614mgkoKvmzgBS1m
n4nFafF7ZM58quTAUWVzsJSDZNQv10ilqz3NV822Xip7NGNf4wLSUgHDc7XGlsoSyLxgrwpljZUh
42+M6RweirtbnwvRsDmsqBPdGtt5wbbR10C0qcB0QEhI8FFxBE8cMnNWRShsMytjcbsElO53yH0b
o6MTeF4wx6dIZ/m05asf7evuB/9HUU7I/BkkgbtJWaD0J6dnuLbOrBP9J1a4D3qOopJryt6ZEI1n
+h8UCTY2mNJpoA1BHdPOge0G+Etjt6bvE/DUBffuu1B8wquHnwMu4ilP0v0q+wtI8mEb4R9BLwsG
8qXMTUg/i2UYS5WPqIjTzVbMrUbJusquKNkpsCvV6ir7fn/VNdA5UUJi6Q9JIgmS3JIphV0TAlAt
+E/pbTk14GEMxasQZSIj761LOWKIQXha1sv3FKjKn9VkdGn/0k2W+R5aXjpfimcE8gX/AhalyO4m
9ppZh0ZW3HfeKbbygPep9Asa+jVbckwQr91YK/olR6yymLfBHM0u/XDixBZ+m2IensngB4DJArLn
wPG20KVSShzjhyntRc1okjnOlOKErDXeF3LivEdPRf6aTrEiGL5rNdoZ/Qmq/MfGfWy//fbb8tc7
Bn00lgfOUGXWlB47+uojWwqRqVOmxOSEmm7IrtB1Xn/wSca48SIkjnaZ6UEOCRmke8fJ1SYnielx
1VrR5O3/XgdBV0jwKZKCICSYnzg4Fx8khB9S6PDp9zGPpmYMAfEvSbizpty6vbHdCGJIEC3WhTqs
Sb8t0qnapJMdCnQAnIrmJEIg8kxntyoEU8fqA+z4efP5qhve0mhgMPOGeuI2TsTapJWOfb1ffI0c
QYUGSJAlR7biN0D1LQqkCJWBIH8J7pwkm21CC+hJ4jv4GIwXp6shvvHfjvHFQy59uKIQfi27vj02
/4uE5ORo4tHgub8meD6wvz6m1112ASiJ7xi/sX7UQbzxlTQmJBbi6ovWi/JK4ZPRVQiiX6AjGPdS
F0P1uINfYB8n9avyjj8sMVbDZ048X0n86dloZQPfQO0aStcGXPxQIcG6OHuLvlt/Y5+xLWeylbjx
memqI2LwT1biuTHW3oH0SHDUhSd6y4UIMgBnQWnX0aJOJa0CN6K5al0nnLsvTnu1z3aW5+mj+Vxo
K0akeRzZHIaxBIO9cPx8jsFpwsfqNF7jAY30sd6l80Mio3OdujI6Q0wlTBXtUjCjGW2YgaBFJ8KW
ivjlGn7J2lAJJrANf0kV8ApJogrnHjcFpUB3Lu4OQB2HR3i0kE5aUvlVrWerNspyBwDAEMuUih+5
Qi0TDcsfbOfl8Te+TiANhkkUsR24xP1YfuLZp7u8yB4QytJXu41wHhSOMhuQxAmXzwWLwO4xxn+v
Obvu3KHAIsJScGP32f2/5P6nad/d5DA15Menu+34+P3P1stOu6Puf+68hDe8//uyvdve3P/8Z7R8
hXSQ3DjcTq8V1It3Fo0/+oRvFMDn83kXNXjt2Y+BdyxlsPZW5R8uY+hvH4wOSPN1nvGLuk3VxUuX
8OLbQdRMvpTgJ+/XbwZsqE73XoMV47dUzLG7Tbw20OAepGyYbzasYFY1hlM8UR74DtBJdSNmTmHE
Bdp/Uo2L9M4nXjxIrrIlNyRvfZXd4jhe8oQFk4lr+WmwgzHOy+9pLQuOMYFDrOUcaJnZgUU3MulT
e9cwriBTvTbyMOTjbI7Xl7jNRMgt13Et09OXFckD0E0VPhbADUFbMcD1zVzfxfyWOwAnG4ydxRGb
BNAzp1QDwoSHRT7QFAt9Cc8cu8DSBYwa7O+xa93CKngnBXC4lgt0wrvyOcCWCaf7eurri+bf1Lwj
9sH8IARXbYFjlh7okIZHZBakT0Ry1pUiw3MTyT/KmsFALuHUtUSNIN6O3p3U1G0XIB2W4fhrcw+y
CiR9hnm8yRyYb5sL0ShrVhqZpAaz0LQydTWMg1S2GDGkLr703V3QmzvUGx+6zBh2F7mC28QqodJx
06bUPIgMIgOf0SknlX1IV3wHdBE3DIRwxx7RbLkRyJxwqyupa2jAHaOEBIodtgV4jRSuri8Zk/wE
1jAgmyAWmjaYp+9Z0g1GJKmuaDE0Iw7jiX5UJoNCdqRWAdAa6QJKoe43g0zoG9udGbkm7EBo00jK
QLwSYri0NpGMl5Ej4J2SCrzi6aO+bIn0gVAMY/mWuPDdsF7/eS95Wr1GbmBu8cPg9Pxy9Pl5aEaC
P7+HgvoZPWI9DOlQHkTdL1Ew6lkDceiwXRF65oLK6FVSzJQUcz0pAweMjYk4DFEZ0aTVCmUQZZLm
EpNiX0kzHQc+oeVyu2YU7onrq1pKa5SUkU+HgZxmOAUInriMX/sIIXSUCS+qCz51yniKIE3XT86W
Mu2qGxoiERY4ARPBHTe5y544RugReNOZ1xT+BuVegYcLghmAWwUnUs9Qu6pY8jm3uf1N4q2YyIoI
6m8gLLmki6pH+6wahojHyaY/GwZlhmzpzhK6jeZUzjw6iesZsU9+J9Ma1Af27BnLdXRIQzDlIm/B
jg8GJ5cXffVmYBZIX3ULyvcoGrYK6vO1oI8teJ8EAoOcaOX8YDh8f3ZxBPJ49QOy3YEytJmqCqR/
mNGWFFsSYFb+ARQgASrjVQIsRTNsMEVxcm+vf3bcM/bQx77ae9s/OHq1NxqMTvqvcnGoy5aP4b/f
ayqovaaac3h29O9GcSffYF4HIr1Gjn9ccXqmTi9BWyOOnx0pLNupsqJappwgRaVo9h+QKpJGokM0
csZaMIp1YT/VcDCAxnLQNwp/PrI8CBFFmLPQy/4II7mTNF6wGV2ZMKXEa2w2XTHHakXi5c/s70XS
8V69Wk1CCf2BSxDl/nBkJQ1RuRP+xYeMxcqwMfAV22DqkyR9/9OZ8KZt2qZt2qZt2qZt2qZt2qZt
2qZt2qZt2qZt2qZt2qZt2v+f9l/lc6U5AFAAAA==

------=_NextPart_000_000B_01C04038.DDACA7C0--