----------------------------------------------------------------------

A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI
has been released. The new version includes many new and advanced
features, which makes it even easier to stay patched.

Download and test it today:
https://psi.secunia.com/

Read more about this new version:
https://psi.secunia.com/?page=changelog

----------------------------------------------------------------------

TITLE:
DotNetNuke Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA29488

VERIFY ADVISORY:
http://secunia.com/advisories/29488/

CRITICAL:
Moderately critical

IMPACT:
Security Bypass, Privilege escalation, System access

WHERE:
>From remote

SOFTWARE:
DotNetNuke 4.x
http://secunia.com/product/12059/

DESCRIPTION:
Some vulnerabilities and a security issue have been reported in
DotNetNuke, which can be exploited by malicious users to gain
escalated privileges or to compromise a vulnerable system, and by
malicious people to bypass certain security restrictions.

1) The problem is that it is possible to upload static files, which
can then be converted into dynamic scripts. This can be exploited to
execute server-side application logic.

Successful exploitation requires access to the file manager and that
the "HTM" or "HTML" file type has been added to the default file
upload extensions.

2) An error in the file manager within the handling of allowed file
types can be exploited to upload arbitrary files and gain escalated
privileges.

Successful exploitation requires access to the file manager.

3) The problem is that under certain circumstances the
"validationkey" is not generated properly. This can be exploited to
access the portal as an arbitrary user, using the the unchanged
default "validationkey".

The security issue and vulnerabilities are reported in versions prior
to 4.8.2.

SOLUTION:
Update to version 4.8.2.
http://www.dotnetnuke.com/tabid/125/default.aspx

PROVIDED AND/OR DISCOVERED BY:
1) The vendor credits Timo Breumelhof.
2) The vendor credits Morteza Kermani.
3) Brian Holyfield

ORIGINAL ADVISORY:
http://www.dotnetnuke.com/News/SecurityBulletins/SecurityBulletinno11/tabid/1147/Default.aspx
http://www.dotnetnuke.com/News/SecurityBulletins/SecurityBulletinno12/tabid/1148/Default.aspx
http://www.dotnetnuke.com/News/SecurityBulletins/SecurityBulletinno13/tabid/1149/Default.aspx

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------