CVE-2009-3583 refers to a security vulnerability in SQL-Ledger (and presumably some offshoots, including early versions of LedgerSMB) whereby one can include arbitrary Perl code. All versions of SQL-Ledger 2.x are presumed vulnerable. At least my experience with SQL-Ledger suggests that the relevant code has not changed significantly since at least 2.2.0. All versions of LedgerSMB lower than 1.2.0 are vulnerable. 1.2.0 is the first version that is not vulnerable. Original full disclosure email at: http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0415.html by another author. I have not checked other offshoots. I am writing because I don't think the original full disclosure email provided sufficient information as to how this could be typically exploited in a system with typical installations of SQL-Ledger or offshoots. Indeed, when combined with standard functionality of the software in typical configurations, the vulnerability is relatively easy to exploit and does not require external upload access. The problem here is that software allows one to create arbitrarily named files in the css and templates directories through the template editor. Since these files are not checked for sanity (and indeed directory transversal has been an issue there too, but that is not necessary to exploit this problem). Hence if one creates a file myperlscript.css in the css directory using the file editor that is built in with SQL-Ledger, one can then execute the Perl code in that file using that vulnerability. Typically, SQL-Ledger and LedgerSMB installations have these directories writeable to the web server. In short, in typical configurations, the application is vulnerable regardless of other applications configured on the system. Early versions of LedgerSMB are vulnerable (but they have many other security problems too). However, in 1.2.0 we moved from perl scripts that set up localization structures to the more standard gettext .po format. For this reason country codes are no longer used to execute arbitrary code. If anyone is still using LedgerSMB 1.1.x, this is an excellent reason to upgrade..... I can confirm this problem for the versions mentioned. Best Wishes, Chris Travers
