Bugzilla Bug 195810

Version bump.
This is mainly a security release, please read the change log.

Reproducible: Always

<snip>
Multiple security issues fixed in the translation module which could be
exploited by user having admin or translation access to SiteBar. A workaround
for version 3.3.8 is to delete the file translator.php, it only used for
translation of SiteBar strings into other languages.
</snip>

CVE-2006-3320 was already fixed in Bug 142597.

I found two issues in the diff of translator.php:
1) Directory traversal via the $lang parameter that allows chmod'ing
   arbitrary files 0777.
2) Arbitrary PHP command execution via $value parameter.

Both are only exploitable for authenticated users.

Created an attachment (id=133465) [details]
SiteBar-3.3.8-translator-security.patch

Security relevant parts of the release.

web-apps, please advise.

According to upstream, this is only exploitable when not running the default
configuration:
"Those bugs are exploitable by users having access to translations and 
only on installations, where admin granted web server rights to write to 
the locales subdirectories (should not be usually the case by default). 
The users who have access to translations are limited to members of 
Admins and Translators group. Translators group is not created by default."

Yes, this is correct. I've coded a while on sitebar and it would take active
user intervention to open these holes. So this does not really affect security.

Anyhow I bumped to 3.3.9 and dropped the stable keyword on ppc.

Maybe ppc could stabilze that version and we can remove 3.3.8 so no user has to
wonder if sitebar is safe or not.

Thanks!

(In reply to comment #6)
> Yes, this is correct. I've coded a while on sitebar and it would take active
> user intervention to open these holes. So this does not really affect security.

It still is a privilege escalation when you give people "translation" rights in
the system and they can execute code on the server or change files.

There were more issues revealed than the ones mentioned in the release notes
and fixed by the patch above. They allow code another way to execute and
retrieve files for arbitrary users, and XSS / redirection flaws for
unauthenticated users.

See: http://www.nth-dimension.org.uk/pub/NDSA20071016.txt.asc

ppc stable

thanks, removing insecure versions. webapps done here

glsa filed.

GLSA 200711-05