Gallery before 1.5.9, and 2.x before 2.2.6, does not properly handle ZIP archives containing symbolic links, which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files via vectors related to the archive upload (aka zip upload) functionality.

New upstream, multiple fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New version, multiple fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New version, multiple security fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200811-02 (Gallery: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Gallery 1 and 2:
    Digital Security Research Group reported a directory traversal     vulnerability in contrib/phpBB2/modules.php in Gallery 1, when     register_globals is enabled (CVE-2008-3600).
    Hanno Boeck reported that Gallery 1 and 2 did not set the secure flag     for the session cookie in an HTTPS session (CVE-2008-3662).
    Alex Ustinov reported that Gallery 1 and 2 does not properly handle ZIP     archives containing symbolic links (CVE-2008-4129).
    The vendor reported a Cross-Site Scripting vulnerability in Gallery 2     (CVE-2008-4130).
  Impact :

    Remote attackers could send specially crafted requests to a server     running Gallery, allowing for the execution of arbitrary code when     register_globals is enabled, or read arbitrary files via directory     traversals otherwise. Attackers could also entice users to visit     crafted links allowing for theft of login credentials.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
37348	Fedora 10 : gallery2-2.3-1.fc10 (2008-11218)	Nessus	Fedora Local Security Checks	medium
35099	Fedora 9 : gallery2-2.3-1.fc9 (2008-11258)	Nessus	Fedora Local Security Checks	medium
35097	Fedora 8 : gallery2-2.3-1.fc8 (2008-11230)	Nessus	Fedora Local Security Checks	medium
34733	GLSA-200811-02 : Gallery: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2008-4129

high

Tenable Plugins

medium

medium

medium

medium