Date: Fri, 27 Oct 2000 17:10:54 +0200 From: "Morpheus[bd]" <morpheusbd@GMX.NET> Subject: CGI-Bug: News Update 1.1 administration password bug To: BUGTRAQ@SECURITYFOCUS.COM This is a multi-part message in MIME format. ------=_NextPart_000_000B_01C04038.DDACA7C0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Hi, there is a vulnerability in News Update 1.1 ((c) by CGIScriptCenter) which allows malicious user to change the news administration password without knowing the correct (former)password. For further information take a look at the attached package, including an advisory and a proof-of-concept exploit. Ciao, Morpheus[bd] www: www.brightdarkness.de mailto: morpheusbd@gmx.net ------=_NextPart_000_000B_01C04038.DDACA7C0 Content-Type: application/x-gzip; name="newsexp.tar.gz" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="newsexp.tar.gz" H4sICF7s9jkAA25ld3NleHAudGFyAO07a3fbNrL9Kv4KVNsmkq23E7cr2dm1YznRWcf2teSm9zg+ PhQJSrymSC4BWlFS/9b7R/rhzgzAlyS7Sa5372OF00YkMBgM5j0g7PO54B/D5nf/wNZqvWj99PIl /FJb/lXPP7UBZHe33YHndruz2/mOvfxHEpW0WEgzYuy7KAjkY3B/NP5/tPla/vh7Aw8N6+nXaLVb rd0XLx6Qf2fnp93dRP4vf9oFuPbOTmv3O9Z6elJW27+4/JtbT9cM9mDL1IuxOmM2F1bkhtIN/Ecm QauvNpow5hPXXwbusqEp2ZklWafNOqBaBGoF4SJyJ1NZBK28rhIMGy/YuyAKpzwWV2P7mubwmel6 q+hnGm5s/3Uy+9jwuTQIvP8x9AJXwlI2Z04QMTnl7BS2zC5D25SctRvttescAywg5cz1YdrMRIYw wTmbLZhp37kiiBZsPnWtKRPTIPZs2DjAAn5XsAYobmPyiRCFpnVrTnhD0fM6mIWu5/qT5onr38Jv l00si3FFJsigHiQvBH8pYG6XzV3PwwXCyPUlt2Fh7tNWNCyDRdFaaMyVQJBkZjSJZ9yXAlZ+QlVq GsY/RzOvjlxheaY749E1Mm8oTd82I5vZaT8zw9BzuWBTHvEGOwqYH0gWC67EEEbBJDJnDTbKvQEm eAl8b0H6wO3YIuGaHgvjKAwEFw1gOwhTAhRbBHGEv5Erbhv/uxm59ai9fk3TyPJsQ6Y5Eei/CBw5 NyPeQ9YwywTWcJCIjNxxLIlrIKYmWY/tOosUGQzEvs2VBUoezUAIDr28Ob1kb7jPIxDBeTz2XIud uBb3QQYmrI89YgqKPc6Q4bRjpGaoqQF7BewkyB7jYAGw0B2PBFptJ1lIY60xoC63zQq4JiVmcntV 2MCCeeAcUhSNL+fZ0wng6Rpo2p9c3/Ji8IF7Qtpu0Ji+KnSBW5kU+yy5CPkymO2542IfOFp7qUss RFME1i2Xq/2IVKxgcOH/pusX+80oNJs4UuzmUeQvke9YvvSW1nInYNBrEPrmjAseraFYmrSS8Seb O7BsqVR63x8Mh6VSIhPyvU6l/KG1s3PV6nX+PCtXE+gVAV6cjdYKtoCk3dtpr0NSenNx2T/9gtmd 3OyM0Df9k8MvWXunMLt0eHJw+cBuAfhFEfhkcHLwMPDLtbt62z85WceX5dm7ODud/u7g18PL4+P+ hYZ+0frz7nrPyQ4uh28ODoFzjxhCE8AkeYNZgNGRcbDxBYQLf5JG2XnkSokBNiDA4ejo7HLEyIw0 Uf1fz0/OBqObwenxWanUYYB14JBDpMAyNwFxknpgAgEpQaPBrKnpT8hFAuY2+kl21D+8fKNeAX/C X+p9FPkRH8eTVdQpuk6eXIUPpNb51pCjGJdE4Pq5Y9qYKRYyKZU3ivw+Tvvvh5fnRwej/s35weht qdy0Jm597PpNO57NFlTaxGGZkJ+CZX4pzhuFtFRWCBqhp3AcQbyY8PnvvrCmMPvcFGIeRJI5v0eQ NRQTP0jwZnm85++PSqVykkcqfG9Ho/P6Bf97zMWXIckRd4MIy+dnwxH7URCmZrvR+hB98MvsgwHC KL8NhOzCYL7vgjvg4Xi03P868H1uYXjqstceJCn5QchWovrBBLR5edqBZfEQereaW0vYQL9lHd1x VyVRKglqfqzP5/N6HHncx5TZXjcLxiZyCksVRvPP4dze/1E8g58O/gousWd7e8jlthaKvb29Mpt4 3ockmoNimxbG8IIE4hmOgJYD6112FxAgn7H3fFwf8ggMmX2KmTBjYEVOKmw4eHd+0r+56P/bZX84 KpXf9L9KJpq2BNvhxdn7YeqOGCtT7eDWD6MACvaIVX5tt3vssgfphh9/ZJ3GC+bu/rxbBRRCuJ/4 jSQHw/0KuD3m2DUoTnzY3V3g2mzrLpRRjWk4v4ocGZm3sB8nCmbs8nTwKyigBAbesnOVmc3QddXZ L4HXYANMkt43Lhpgq+DYfLIcxj5Tlp0g9bgje6on6dIer6fLMiQHPErEtoCanqpc4IntszvqwHdC Az16EpRCHq+ozlesVdVrQt7nsAqrJCvABNp8BfdNW6Up1Srb28/PUvMo2LP9fdYfnI4uqrlaIYev 1Uv7uSd4DijiMo58Vqm3qwnMvf5VhNb3l7autrm93K1mJeh8wnYP4oScAZLVhIuzxU3ETTsTa8LB J5HiZ6Ok1wP8JVzoBvIetf9kBFcsbdEYyanQT93j2LnCCHoNUi0hi1NECf/Nien6XVB8JbjcQrQ5 3FiCSelp4FSSjirKUaHB5GCdCFXSMAkgRtFKPTQxxVklp1LpnuTICtTtI3U50BZBJjvVxCEJ0A2S SflTr0PHlgJJGbO93TMSRLjkfWaZCALlOU+FuMYqZ+ZHcIFPJVSUZskHplpAFAnKqiV2V8obXQnL 1QpqPLgXH/is6IDn7W3FcS0xC0ASXcQtPLNALMDAtoIidmxvA5BFzMdZFo4//+A/Jx6XxjD3tleC DUKARXao84UAKr0a89xbzpwJl6JSxT0UBWYpUamVsMdXSxPeTHiIu392DOYfMIikJjFeYSuRFefI SGFFgCkCQs8h0Gcz1PpLikTTQPsCEJxSQghDKAPii6IcNUUrR0ttN4YMEItT18fwvrJVjd9XSkMp Efc8SXnBLzyCzMaOQeSfIFJR5DrH7AOTGhWe6KACEaF2TaUMb6w0rlfIXUwh/ly1W63raua2ZRRb kmFJZdp2dAPxUZi9/BBOwlR2axpqZ434cYJj99L3EGnZZz+3NIwahx5VrFUOjiHj7I9qbHj2+m83 w9FF/+BdjbW06xx/4lFQeSbM1OiFWdVjwmwI179xzJkL+ek+05gKg3r1qYTgUsEXPVfprAbC/TUE /QAsFn/0XMENKh0GyWpHXYwUrDINYUplmSNVyAclvo0XWPrlMJ1enpzkI8rn3DPVb71CR0iqVCkX 0HXL1SIUlYzFrjVBKB+IGJvxmRUukLXLPKhNw/qrqXrUTM96qrmYlnJSq1NFybaW8iNRHmTIsgzJ Y68wtcCAZPM6Cy1s28JsVC+Y617ixIOhWA9kygq7oTRQVU8c6gxzXU2Ah0nwOPV4/J8S80BwVZAk Jjm/TV3a0uiIO6bZN/rAVFnbFooyDdSmnGZWh/Nc9Au1zFB0pkHg1sy+SkvT614mgkoKvmzgBS1m n4nFafF7ZM58quTAUWVzsJSDZNQv10ilqz3NV822Xip7NGNf4wLSUgHDc7XGlsoSyLxgrwpljZUh 42+M6RweirtbnwvRsDmsqBPdGtt5wbbR10C0qcB0QEhI8FFxBE8cMnNWRShsMytjcbsElO53yH0b o6MTeF4wx6dIZ/m05asf7evuB/9HUU7I/BkkgbtJWaD0J6dnuLbOrBP9J1a4D3qOopJryt6ZEI1n +h8UCTY2mNJpoA1BHdPOge0G+Etjt6bvE/DUBffuu1B8wquHnwMu4ilP0v0q+wtI8mEb4R9BLwsG 8qXMTUg/i2UYS5WPqIjTzVbMrUbJusquKNkpsCvV6ir7fn/VNdA5UUJi6Q9JIgmS3JIphV0TAlAt +E/pbTk14GEMxasQZSIj761LOWKIQXha1sv3FKjKn9VkdGn/0k2W+R5aXjpfimcE8gX/AhalyO4m 9ppZh0ZW3HfeKbbygPep9Asa+jVbckwQr91YK/olR6yymLfBHM0u/XDixBZ+m2IensngB4DJArLn wPG20KVSShzjhyntRc1okjnOlOKErDXeF3LivEdPRf6aTrEiGL5rNdoZ/Qmq/MfGfWy//fbb8tc7 Bn00lgfOUGXWlB47+uojWwqRqVOmxOSEmm7IrtB1Xn/wSca48SIkjnaZ6UEOCRmke8fJ1SYnielx 1VrR5O3/XgdBV0jwKZKCICSYnzg4Fx8khB9S6PDp9zGPpmYMAfEvSbizpty6vbHdCGJIEC3WhTqs Sb8t0qnapJMdCnQAnIrmJEIg8kxntyoEU8fqA+z4efP5qhve0mhgMPOGeuI2TsTapJWOfb1ffI0c QYUGSJAlR7biN0D1LQqkCJWBIH8J7pwkm21CC+hJ4jv4GIwXp6shvvHfjvHFQy59uKIQfi27vj02 /4uE5ORo4tHgub8meD6wvz6m1112ASiJ7xi/sX7UQbzxlTQmJBbi6ovWi/JK4ZPRVQiiX6AjGPdS F0P1uINfYB8n9avyjj8sMVbDZ048X0n86dloZQPfQO0aStcGXPxQIcG6OHuLvlt/Y5+xLWeylbjx memqI2LwT1biuTHW3oH0SHDUhSd6y4UIMgBnQWnX0aJOJa0CN6K5al0nnLsvTnu1z3aW5+mj+Vxo K0akeRzZHIaxBIO9cPx8jsFpwsfqNF7jAY30sd6l80Mio3OdujI6Q0wlTBXtUjCjGW2YgaBFJ8KW ivjlGn7J2lAJJrANf0kV8ApJogrnHjcFpUB3Lu4OQB2HR3i0kE5aUvlVrWerNspyBwDAEMuUih+5 Qi0TDcsfbOfl8Te+TiANhkkUsR24xP1YfuLZp7u8yB4QytJXu41wHhSOMhuQxAmXzwWLwO4xxn+v Obvu3KHAIsJScGP32f2/5P6nad/d5DA15Menu+34+P3P1stOu6Puf+68hDe8//uyvdve3P/8Z7R8 hXSQ3DjcTq8V1It3Fo0/+oRvFMDn83kXNXjt2Y+BdyxlsPZW5R8uY+hvH4wOSPN1nvGLuk3VxUuX 8OLbQdRMvpTgJ+/XbwZsqE73XoMV47dUzLG7Tbw20OAepGyYbzasYFY1hlM8UR74DtBJdSNmTmHE Bdp/Uo2L9M4nXjxIrrIlNyRvfZXd4jhe8oQFk4lr+WmwgzHOy+9pLQuOMYFDrOUcaJnZgUU3MulT e9cwriBTvTbyMOTjbI7Xl7jNRMgt13Et09OXFckD0E0VPhbADUFbMcD1zVzfxfyWOwAnG4ydxRGb BNAzp1QDwoSHRT7QFAt9Cc8cu8DSBYwa7O+xa93CKngnBXC4lgt0wrvyOcCWCaf7eurri+bf1Lwj 9sH8IARXbYFjlh7okIZHZBakT0Ry1pUiw3MTyT/KmsFALuHUtUSNIN6O3p3U1G0XIB2W4fhrcw+y CiR9hnm8yRyYb5sL0ShrVhqZpAaz0LQydTWMg1S2GDGkLr703V3QmzvUGx+6zBh2F7mC28QqodJx 06bUPIgMIgOf0SknlX1IV3wHdBE3DIRwxx7RbLkRyJxwqyupa2jAHaOEBIodtgV4jRSuri8Zk/wE 1jAgmyAWmjaYp+9Z0g1GJKmuaDE0Iw7jiX5UJoNCdqRWAdAa6QJKoe43g0zoG9udGbkm7EBo00jK QLwSYri0NpGMl5Ej4J2SCrzi6aO+bIn0gVAMY/mWuPDdsF7/eS95Wr1GbmBu8cPg9Pxy9Pl5aEaC P7+HgvoZPWI9DOlQHkTdL1Ew6lkDceiwXRF65oLK6FVSzJQUcz0pAweMjYk4DFEZ0aTVCmUQZZLm EpNiX0kzHQc+oeVyu2YU7onrq1pKa5SUkU+HgZxmOAUInriMX/sIIXSUCS+qCz51yniKIE3XT86W Mu2qGxoiERY4ARPBHTe5y544RugReNOZ1xT+BuVegYcLghmAWwUnUs9Qu6pY8jm3uf1N4q2YyIoI 6m8gLLmki6pH+6wahojHyaY/GwZlhmzpzhK6jeZUzjw6iesZsU9+J9Ma1Af27BnLdXRIQzDlIm/B jg8GJ5cXffVmYBZIX3ULyvcoGrYK6vO1oI8teJ8EAoOcaOX8YDh8f3ZxBPJ49QOy3YEytJmqCqR/ mNGWFFsSYFb+ARQgASrjVQIsRTNsMEVxcm+vf3bcM/bQx77ae9s/OHq1NxqMTvqvcnGoy5aP4b/f ayqovaaac3h29O9GcSffYF4HIr1Gjn9ccXqmTi9BWyOOnx0pLNupsqJappwgRaVo9h+QKpJGokM0 csZaMIp1YT/VcDCAxnLQNwp/PrI8CBFFmLPQy/4II7mTNF6wGV2ZMKXEa2w2XTHHakXi5c/s70XS 8V69Wk1CCf2BSxDl/nBkJQ1RuRP+xYeMxcqwMfAV22DqkyR9/9OZ8KZt2qZt2qZt2qZt2qZt2qZt 2qZt2qZt2qZt2qZt2qZt2v+f9l/lc6U5AFAAAA== ------=_NextPart_000_000B_01C04038.DDACA7C0--