Tag: Arbitrary File Read

ASA-2020-00040 – Canonical Ubuntu: Arbitrary file read and arbitrary module loading due to incorrectly handled module loading in the ppp package

Posted on by Allele Security Intelligence in Alerts

The ppp package in Ubuntu contains a patch to load the ppp_generic kernel module when it's not built by default in the Linux kernel. The patch has a vulnerability that allows an attacker to influence the behavior of the modprobe binary using MODPROBE_OPTIONS environment variable. This vulnerability leads to arbitrary file read or arbitrary kernel module loading.

ASA-2019-00634 – PhantomJS: Arbitrary File Read Vulnerability

Posted on by Allele Security Intelligence in Alerts

PhantomJS uses internal module: webpage, to open, close, render, and perform multiple actions on webpages, which suffers from an arbitrary file read vulnerability. The vulnerability exists in the page.open() function of the webpage module, which loads the specified URL and calls a given callback. When opening a HTML file, an attacker can supply specially crafted file content, which allows reading arbitrary files on the filesystem. The vulnerability is demonstrated by using page.render() as the function callback, resulting in the generation of a PDF or an image of the targeted file.

ASA-2019-00620 – Samba: Client code can return filenames containing path separators

Posted on by Allele Security Intelligence in Alerts

Samba client code (libsmbclient) returns server-supplied filenames to calling code without checking for pathname separators (such as "/" or"../") in the server returned names. A malicious server can craft a pathname containing separators and return this to client code, causing the client to use this access local pathnames for reading or writing instead of SMB network pathnames. This access is done using the local privileges of the client. This attack can be achieved using any of SMB1/2/3 as it is not reliant on any specific SMB protocol version.

ASA-2019-00545 – BlueStacks: Arbitrary File Read with System admin privilege

Posted on by Allele Security Intelligence in Alerts

BlueStacks employs Android running in a virtual machine (VM) to enable Android apps to run on Windows or MacOS. Bug is in a local arbitrary file read through a system service call. The impacted method runs with System admin privilege and if given the file name as parameter returns you the content of file. A malicious app using the affected method can then read the content of any system file which it is not authorized to read.

ASA-2019-00252 – IBM Planning Analytics: Apache Derby XML External Entity (XXE) information disclosure

Posted on by Allele Security Intelligence in Alerts

Apache Derby could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML datatype and XmlVTI. An attacker could exploit this vulnerability to read arbitrary files on the system or cause a denial of service.

ASA-2019-00035 – phpMyAdmin: Arbitrary file read vulnerability

Posted on by Allele Security Intelligence in Alerts

When AllowArbitraryServer configuration set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. phpMyadmin attempts to block the use of LOAD DATA INFILE, but due to a bug in PHP, this check is not honored. Additionally, when using the 'mysql' extension, mysql.allow_local_infile is enabled by default. Both of these conditions allow the attack to occur.