Thanks to Digital Armaments for the notification and allowing us to rev up a patch before posting the flaw. Corrections to the advisory inline below. info@xxxxxxxxxxxxxxxxxxxx wrote: ... > II. Problem Description > > Every user with privileges (who can modify appareance of one > Gallery's album) can include any file located on the server. This > vulnerability can be found in util.php. It allows to an attacker to > read files on the remote system or execute arbitrary PHP code with > apache privileges if the attacker can upload files. A user with active admin privileges must be tricked into clicking on a carefully crafted url in order to set up this attack. It can only be used to execute PHP files on the local system, so the attacker must contrive some other way to get the PHP file onto the server before it can be used, therefore this advisory is not a "remote file execution" as mentioned in the subject line. > V. Solution > > First notification 12.20.2005. No first notification was received to our security mailing list. For security notifications, please notify security@xxxxxxxxxxxxxxxxxxxx Thank you. > Second notification 01.14.2006. > The vendor answered second notification. A new patched version is > available. The security fix released is available here: http://gallery.menalto.com/gallery_1_5_2_pl2_security_release -Bharat Gallery Project Lead
