Bugzilla Bug 203217

hi

from <gallery-announce@lists.sourceforge.net>
--8<--
Just in time for the holidays, Gallery 2.2.4 is now available for download.
This release fixes critical security issues, no new features have been
added. Due to the severity of these issues users of all previous Gallery 2
versions are strongly encouraged to upgrade to version 2.2.4 as soon as
possible! All issues addressed in this release were discovered through an
extensive internal security audit.

Since 2.2.4 is a security release, it shares the same installation
requirements as 2.2.3. If you haven't upgraded to 2.2.x yet, please review
the Gallery 2.2 release notes for highlights of changes and the
requirements. Read on for more details and upgrade instructions. 

Details:
http://gallery.menalto.com/gallery_2.2.4_released

Download:
http://codex.gallery2.org/Gallery2:Download#Packages
--8<--

Thanks for reporting this to us.

web-apps, please bump.

Hi, I am with the Gallery team and was wondering if there would be a good
person to email about the Gallery ebuild.  Perhaps the web-apps@gentoo.org or
something?

(In reply to comment #2)
> Hi, I am with the Gallery team and was wondering if there would be a good
> person to email about the Gallery ebuild.  Perhaps the web-apps@gentoo.org or
> something?
> 

Yes, mailing web-apps is probably the best way to go. But if you already have a
working ebuild for 2.2.4, feel free to attach it here.

*** Bug 204244 has been marked as a duplicate of this bug. ***

Created an attachment (id=140022) [details]
gallery 2.2.4 ebuild

Here is my local patched gallery 2.2.4 ebuild. Tested on amd64.

2.2.4 is in the tree.

Target archs:

alpha amd64 hppa ppc ppc64 sparc x86

@donald webster:

We also offer ebuilds for gallery-1.5.3 (stable) and gallery-1.5.5 (unstable).
Are these versions affected and should they be removed?

x86 stable

alpha/sparc stable

Stable for HPPA.

ppc64 done

www-apps/gallery-2.2.4  USE="ffmpeg gd -imagemagick -mysql -netpbm -postgres
-raw -unzip -vhosts -zip"

1. Emerges on AMD64. 
2. No collisions etc. 
3. Works. Executed setup from scratch and added album with some pictures. Was
able to view album as well. 

Portage 2.1.3.19 (default-linux/amd64/2007.0/desktop, gcc-4.1.2,
glibc-2.6.1-r0, 2.6.23-gentoo-r3 x86_64)
=================================================================
System uname: 2.6.23-gentoo-r3 x86_64 Intel(R) Core(TM)2 CPU 6600 @ 2.40GHz
Timestamp of tree: Fri, 11 Jan 2008 22:46:01 +0000
distcc 2.18.3 x86_64-pc-linux-gnu (protocols 1 and 2) (default port 3632)
[enabled]
ccache version 2.4 [enabled]
app-shells/bash:     3.2_p17-r1
dev-java/java-config: 1.3.7, 2.0.33-r1
dev-lang/python:     2.4.4-r6
dev-python/pycrypto: 2.0.1-r6
dev-util/ccache:     2.4-r7
sys-apps/baselayout: 1.12.10-r5
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.13, 2.61-r1
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.18-r1
sys-devel/gcc-config: 1.4.0-r4
sys-devel/libtool:   1.5.24
virtual/os-headers:  2.6.23-r2
ACCEPT_KEYWORDS="amd64"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=nocona -Os -msse3 -pipe -fomit-frame-pointer"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config
/usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf
/etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/
/etc/php/cli-php5/ext-active/ /etc/revdep-rebuild /etc/splash /etc/terminfo
/etc/udev/rules.d"
CXXFLAGS="-march=nocona -Os -msse3 -pipe -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
FEATURES="ccache collision-protect distcc distlocks metadata-transfer
multilib-strict parallel-fetch sandbox sfperms strict test unmerge-orphans
userfetch"
GENTOO_MIRRORS="http://ftp.belnet.be/mirror/rsync.gentoo.org/gentoo/
http://trumpetti.atm.tut.fi/gentoo/
http://ftp.snt.utwente.nl/pub/os/linux/gentoo
http://ds.thn.htu.se/linux/gentoo"
LC_ALL="en_DK.utf8"
MAKEOPTS="-j6"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude=/distfiles --exclude=/local --exclude=/packages
--filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/portage/local/layman/php-testing
/usr/portage/local/layman/mozilla /usr/portage/local/layman/kde
/usr/local/portage"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="X a52 aac acl acpi aiglx alsa amd64 apache2 arts atk berkdb bitmap-fonts
cairo cdr cli cracklib crypt cups dbus dga directfb dri dts dvd dvdr dvdread
eds emboss encode evo fam fbcn ffmpeg firefox fortran ftp gd gdbm gif gphoto2
gpm gstreamer gtk hal iconv icq ieee1394 ipv6 isdnlog java jpeg kde kerberos
live lm_sensors mad midi mikmod mjpeg mmx mozilla mp2 mp3 mpeg mplayer msn
mudflap ncurses nls nptl nptlonly ogg oggvorbis opengl openmp pam pcre pda pdf
perl png ppds pppd python qt qt3 qt3support qt4 quicktime readline reflection
samba sdl session spell spl sse sse2 sse3 ssl svg tcpd test threads tiff
truetype truetype-fonts type1-fonts unicode vorbis x264 xcomposite xml xorg
xscreensaver xv xvid zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem
bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel
intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci"
ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file
hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route
share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias
authn_anon authn_dbm authn_default authn_file authz_dbm authz_default
authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs
dav_lock deflate dir disk_cache env expires ext_filter file_cache filter
headers include info log_config logio mem_cache mime mime_magic negotiation
rewrite setenvif speling status unique_id userdir usertrack vhost_alias"
ELIBC="glibc" INPUT_DEVICES="keyboard mouse" KERNEL="linux" LCD_DEVICES="bayrad
cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" USERLAND="GNU"
VIDEO_CARDS="radeon"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LDFLAGS,
LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

Just upgraded from the portage tree withou any problems on a running
isntallation AMD64.

ppc stable

amd64 stable

gallery-1.5.* is unaffected but I upgraded that branch to 1.5.7.

Removed insecure 2.2.3. webapps done.

Is it just me or should this be B0? Local file inclusion + unauthorized file
upload?

GLSA request filed anyways.

Ok B1 then?

CVE-2007-6685 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6685):
  Unspecified vulnerability in the Publish XP module Menalto Gallery before
  2.2.4 allows attackers to create albums and upload files via unknown vectors.

CVE-2007-6686 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6686):
  The URL rewrite module in Menalto Gallery before 2.2.4 allows attackers to
  include and execute arbitrary local files via unknown vectors related to the
  admin controller.

CVE-2007-6687 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6687):
  Multiple cross-site scripting (XSS) vulnerabilities in Menalto Gallery before
  2.2.4 allow remote attackers to inject arbitrary web script or HTML via
  crafted filenames to the (1) Core or (2) add-item modules; or via (3) HTTP
  PROPPATCH in the WebDAV module.

CVE-2007-6688 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6688):
  Unspecified vulnerability in the Installation application in Menalto Gallery
  before 2.2.4 has unknown impact and attack vectors related to
  "web-accessibility protection of the storage folder."

CVE-2007-6689 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6689):
  Menalto Gallery before 2.2.4 does not properly check for malicious file
  extensions during file uploads, which allows attackers to execute arbitrary
  code via the (1) Core application or (2) MIME module.

CVE-2007-6690 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6690):
  The Gallery Remote module in Menalto Gallery before 2.2.4 does not check
  permissions for unspecified GR commands, which has unknown impact and attack
  vectors.

CVE-2007-6691 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6691):
  Multiple unspecified vulnerabilities in Menalto Gallery before 2.2.4 have
  unknown impact, related to (1) "hotlink protection" in the URL rewrite
  module, (2) a WebDAV view in the WebDAV module, (3) a comment view in the
  Comment module, (4) unspecified "item information disclosure attacks" in the
  Core module Gallery application, (5) the slideshow in the Slideshow module,
  and (6) multiple Print modules.

CVE-2007-6692 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6692):
  Open redirect vulnerability in Menalto Gallery before 2.2.4 allows remote
  attackers to redirect users to arbitrary web sites and conduct phishing
  attacks via a URL in the (1) Core and (2) print modules.

CVE-2007-6693 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6693):
  Unspecified vulnerability in the WebCam module in Menalto Gallery before
  2.2.4 has unknown impact and attack vectors related to a "proxied request."

GLSA 200802-04.