PT-2013-1421 · Binarycanary · Timthumb

Hanno Böck · Publicado 2013-10-26 · Atualizado 2013-10-28 · CVE-2011-4106

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TimThumb (timthumb.php) versions prior to 2.0

Description The issue allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter. This is done by accessing the uploaded file via a direct request to the file in the cache directory. There have been real-world incidents where this issue was exploited, notably in August 2011.

Recommendations For versions prior to 2.0, update to version 2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the cache directory to minimize the risk of exploitation. Avoid using the src parameter with untrusted input until the issue is resolved.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-4106

Produtos afetados

Timthumb

Referências · 11

• 🔥 http://exploit-db.com/exploits/17872 · Exploit
• 🔥 http://code.google.com/p/timthumb/issues/detail?id=212 · Exploit
• 🔥 http://exploit-db.com/exploits/17602 · Exploit
• 🔥 https://exploit-db.com/exploits/17602 · Exploit
• 🔥 https://exploit-db.com/exploits/17872 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4106 · Nota de Segurança
• http://markmaunder.com/2011/08/02/technical-details-and-scripts-of-the-wordpress-timthumb-php-hack · Correção
• http://markmaunder.com/2011/08/01/zero-day-vulnerability-in-many-wordpress-themes · Nota
• http://openwall.com/lists/oss-security/2011/11/03/4 · Nota
• http://binarymoon.co.uk/2011/08/timthumb-2 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4106 · Nota