Bugzilla Bug 73021

http://www.phprojekt.com/modules.php?op=modload&name=News&file=article&sid=189&mode=thread&order=0

fixed setup.php: http://phprojekt.com/files/4.2/setup.zip

web-apps pls provide an updated ebuild

rating this B1 for now, if it really allows to upload and execute scripts with the rights of the user running the webserver
carlo, web-apps, can you confirm that?

According to http://www.heise.de/security/news/meldung/53813 (German), this
allows to upload and run any PHP-script with the standard test account.
Furthermore it's said to be able to get the database password even without
making use of the test account. All versions of PHProjekt seem to be affected.

Btw, it.sec <http://www.it-sec.de/> who reported this (or Martin M

According to http://www.heise.de/security/news/meldung/53813 (German), this
allows to upload and run any PHP-script with the standard test account.
Furthermore it's said to be able to get the database password even without
making use of the test account. All versions of PHProjekt seem to be affected.

Btw, it.sec <http://www.it-sec.de/> who reported this (or Martin Münch of
it.sec), are linking to the article mentioned above.

Um, I wasn't 100% correct. I read here
http://www.heise.de/newsticker/meldung/53813 about it. It's said, that it's
possible to load and start arbitrary php-scripts via the test account and to
obtain the db password w/o any account. I guess that the latter is possible
locally only, but I won't install and test phprojekt. The information from the
phprojekt guys isn't very helpful, too.

According to the phprojekt website this seems to allow unauthorized changes to
the configuration, which, according to heise, could then allow uploading and
execution of scripts using the default test account.

The tarball on their site seems to have the updated setup.php included already,
our distfile mirrors are spreading the vulnerable version.

http://securitytracker.com/alerts/2004/Dec/1012369.html
http://secunia.com/advisories/13355/
_______

web-apps, pls verify and provide a fixed ebuild asap
This bug has been opened nearly a week ago.

phprojekt-4.2-r1 is now in the tree.  Sorry for the delay.

Best regards
Stu

archs, please mark phprojekt-4.2-r1 stable.

stable on ppc

x86 stable

GLSA sent, but lists are slow as hell, I didn't even received the
gentoo-announce feedback... Probably will commit the mail tomorrow so please be
patient.

Reposted... now it works.
GLSA 200412-06