Bug 112968 – www-apps/mambo <=4.5.2.3 "register_globals" Emulation Layer Overwrite Vulnerability

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Vic Fryzel (shellsage) (RETIRED) 2005-11-18 22:01:26 UTC]

Secunia:
peter MC tachatte has discovered a vulnerability in Mambo, which can
be exploited by malicious people to manipulate certain information
and compromise a vulnerable system.

The vulnerability is caused due to an error in the "register_globals"
emulation layer in "globals.php" where certain arrays used by the
system can be overwritten. This can be exploited to include arbitrary
files from external and local resources via the
"mosConfig_absolute_path" parameter.

Reproducible: Always
Steps to Reproduce:
1.
2.
3.

[Comment 1 Vic Fryzel (shellsage) (RETIRED) 2005-11-18 22:14:56 UTC]

Created attachment 73163 [details, diff]
Patch to fix globals overwrite vulnerability in globals.php.

As of now no upstream patch or patched version is available. Here is a patch
that should fix the vulnerability from overwriting already defined elements in
$GLOBALS.

[Comment 2 Vic Fryzel (shellsage) (RETIRED) 2005-11-18 22:29:41 UTC]

I've notified upstream about the vulnerability and sent them the patch.

[Comment 3 Vic Fryzel (shellsage) (RETIRED) 2005-11-19 00:02:02 UTC]

Created attachment 73169 [details]
Ebuild for =www-apps/mambo-4.5.2.3-r1

Sending ebuild that applies mambo-4.5.2.3-globals_overwrite.patch.

[Comment 4 Thierry Carrez (RETIRED) 2005-11-19 03:24:19 UTC]

One more for web-apps, an urgent one here :)

[Comment 5 Stuart Herbert (RETIRED) 2005-11-19 12:55:05 UTC]

I'm looking at this problem today.  I'll update this ticket again once I have a
fix in Portage for you.

Best regards,
Stu

[Comment 6 Stuart Herbert (RETIRED) 2005-11-20 02:42:07 UTC]

Hi,

Mambo-4.5.2.3-r1 is now in the tree.  Many thanks to Vic for the patch.

Best regards,
Stu

[Comment 7 Sune Kloppenborg Jeppesen (RETIRED) 2005-11-20 03:04:59 UTC]

Thx Stuart. Mambo is not stable on any arches -> Closing with NO GLSA.