[cobalt-users] Php Gallery root exploit

["Bob Noordam" <mac@xxxxxxxx>]

Altough not strictly cobalt-only related, and certanly not a SUN issue, i
know this may hit multiple users around here, so i took the liberty of
posting

Several users from the forums, mailing lists or my website directly followed
a HOWTo document to install php Gallery version 1.3x on the Qube3 or RAQ550.
Today, Secunia announced a major security problem with the program. The
authors advice everyone to update to the latest version of gallery. However,
this version DOES NOT WORK on your Qube without major work. (1.4 has quite
different system requirements from the 1.3 version).

Below is the fix for users of version 1.3x. Modify the INIT.PHP file, and
add the lines as indicated. If you do not fix this, full access may be
gained to your machine.


edit init.php and look for the following code;


if (!$gallery->register_globals) {
    extract($HTTP_GET_VARS);
    extract($HTTP_POST_VARS);
    extract($HTTP_COOKIE_VARS);


and insert the new code


if (!$gallery->register_globals) {

    /* START OF NEW CODE */
    $scrubList = array('HTTP_GET_VARS', 'HTTP_POST_VARS',
'HTTP_COOKIE_VARS', 'HTTP_POST_FILES');
    foreach ($scrubList as $outer) {
       foreach ($scrubList as $inner) {
           unset(${$outer}[$inner]);
       }
    }
    /* END OF NEW CODE */

    extract($HTTP_GET_VARS);
    extract($HTTP_POST_VARS);
    extract($HTTP_COOKIE_VARS);