Re: Files upload security considerations

[Hemil <hemil () net-square com>]

Hi,
   I think everyone misses the threat to the sever from viruses and 
warms. You should keep your server up to date to protect from viruses 
and you should also check fr uploaded files for viruses and warms. If it 
is Microsoft Office document, you should also check fr the embedded macros.

---Hemil
[Net-square]
c0redump () ackers org uk wrote:
> Hi Alexander,
>
> There are huge security implications of allowing users to upload to a 
> web server.  Off the top of my head I'm thinking of things like an 
> evil user being able to use a phpshell via an evil .php page.  The 
> list is endless.
>
> However, here are a few links you may find interesting.
>
> http://www.acunetix.com/websitesecurity/php-security-4.htm
> http://www.developershome.com/wap/wapUpload/wap_upload.asp?page=security
>
> Again, it depends on whether you're running IIS or Apache as to the 
> seriousness of the security risk.
>
> Good luck.
>
> Tom
>
> ----- Original Message ----- From: Alexander Berezhnoy
> To: webappsec () securityfocus com
> Sent: Thursday, November 09, 2006 9:12 AM
> Subject: Files upload security considerations
>
>
> Hi!
>
> Recently we have got a new requirement for our system which consists
> in allowing customers to send us their scanned documents. In this
> connexion, I want to find an information about corresponding security
> considerations with.
>
> Namely,
>
> - Ways of file delivery  (HTTP POST, FTP, e-mail)
> - Main risks
> - Mitigations
> - Formats (JPG, GIF, PDF)
> - Signatures
> - Known and historic vulnerabilities
>
> We use Weblogic and Struts.
>
> I realize, that there is not enough information to make any decision,
> but, at least, there sould be some common considerations and "best
> practices".
>
> Thanks in advance,
> Alexander.
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
>
> It's been reported that 75% of websites are vulnerable to attack. 
> That's because hackers know to exploit weaknesses in web applications. 
> Traditional approaches to securing these assets no longer apply. 
> Download the "Addressing Challenges in Application Security" 
> whitepaper today, and see for yourself.
>
> https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008YTU
> -------------------------------------------------------------------------- 


-------------------------------------------------------------------------
Sponsored by: Watchfire

It's been reported that 75% of websites are vulnerable to attack. That's 
because hackers know to exploit weaknesses in web applications. 
Traditional approaches to securing these assets no longer apply. 
Download the "Addressing Challenges in Application Security" whitepaper 
today, and see for yourself.

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008YTU
--------------------------------------------------------------------------