Bug 111423 – www-apps/mambo: path disclosure

• Status: RESOLVED INVALID
• Product: Gentoo Security

[Description Carsten Lohrke (RETIRED) 2005-11-03 16:14:46 UTC]

A remote user can supply a specially crafted URL to cause the system to display
an error message that
discloses the installation path and other data.

http://irannetjob.com/content/view/153/28/

Maybe www-apps/joomla is affected, too?

[Comment 1 Sune Kloppenborg Jeppesen (RETIRED) 2005-11-03 23:41:41 UTC]

web-apps please advise. 

[Comment 2 Thierry Carrez (RETIRED) 2005-11-08 00:39:48 UTC]

That would be the patch :

========================================
in /component/com_content/content.php
Approx Line 190 Change the block FROM:

Code:
// Paramters
	$params = new stdClass();
	if ( $Itemid ) {
		$menu = new mosMenu( $database );
		$menu->load( $Itemid );
		$params =& new mosParameters( $menu->params );
	} else {
		$menu = "";
		$params =& new mosEmpty();

	}

CHANGE TO READ:

Code:
// Paramters
	$params = new stdClass();
	if ( $Itemid ) {
		$menu = new mosMenu( $database );
		$menu->load( $Itemid );
		$params =& new mosParameters( $menu->params );
	} else {
		$menu = "";
		$params =& new mosParameters(''); //mosEmpty();

	}
=================================

This still has to be confirmed. web-apps herd, please have a look ?

[Comment 3 Vic Fryzel (shellsage) (RETIRED) 2005-11-15 19:02:03 UTC]

I was able to confirm a full path disclosure via a PHP error from a call to an
undefined function set(). I'm assuming this is what the bug is referring to, but
does not at all seem significant.

[Comment 4 Thierry Carrez (RETIRED) 2005-11-16 04:38:55 UTC]

Yes, this seems rather minor to me. I propose to close it as WONTFIX, and let
the fix filter from upstream some day.

[Comment 5 Tavis Ormandy (RETIRED) 2005-11-16 08:34:09 UTC]

concur with Koon, path disclosure has a questionable security impact.

[Comment 6 Sune Kloppenborg Jeppesen (RETIRED) 2005-11-16 11:56:54 UTC]

I agree if upstream has been informed. 

[Comment 7 Thierry Carrez (RETIRED) 2005-11-17 01:54:05 UTC]

Closing as INVALID -- no real security impact.