Bug 186931 – www-apps/phpsysinfo < 2.5.4 Cross-Site Scripting vulnerability (CVE-2007-4048)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Matt Fleming (RETIRED) 2007-07-28 21:28:06 UTC]

A cross-site scripting vulnerability has been discovered in phpSysinfo 2.5.3.

Input passed in the URL to index.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Reproducible: Sometimes

Steps to Reproduce:

[Comment 1 Matt Fleming (RETIRED) 2007-08-08 21:46:40 UTC]

Add CVE number

[Comment 2 Gunnar Wrobel (RETIRED) 2007-08-30 14:21:10 UTC]

Updated to 2.5.4.

Please mark stable on

alpha amd64 hppa ppc ppc64 sparc x86

[Comment 3 Pierre-Yves Rofes (RETIRED) 2007-08-31 07:47:49 UTC]

hi arches, please test and mark stable phpsysinfo-2.5.4.
Target keywords are: "alpha amd64 hppa ppc ppc64 sparc x86 ~x86-fbsd"

[Comment 4 Jeroen Roovers (RETIRED) 2007-08-31 15:21:54 UTC]

Stable for HPPA.

[Comment 5 Raúl Porcel (RETIRED) 2007-08-31 15:46:38 UTC]

alpha/x86 stable

[Comment 6 Thomas Anderson (tanderson) (RETIRED) 2007-08-31 16:45:44 UTC]

====amd64====

Merges+works on my server box.

Portage 2.1.2.12 (default-linux/amd64/2007.0/desktop, gcc-4.1.2, glibc-2.5-r4, 2.6.17-gentoo-r8 x86_64)
=================================================================
System uname: 2.6.17-gentoo-r8 x86_64 AMD Turion(tm) 64 Mobile Technology MT-37
Gentoo Base System release 1.12.9
Timestamp of tree: Thu, 30 Aug 2007 23:00:01 +0000
distcc 2.18.3 x86_64-pc-linux-gnu (protocols 1 and 2) (default port 3632) [disabled]
app-shells/bash:     3.2_p17
dev-lang/python:     2.4.4-r4
dev-python/pycrypto: 2.0.1-r6
sys-apps/baselayout: 1.12.9-r2
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.61
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.17
sys-devel/gcc-config: 1.3.16
sys-devel/libtool:   1.5.24
virtual/os-headers:  2.6.21
ACCEPT_KEYWORDS="amd64"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=athlon64 -O2 -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/X11/xkb"
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/php/apache2-php5/ext-active/ /etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/terminfo"
CXXFLAGS="-march=athlon64 -O2 -pipe"
DISTDIR="/distfiles"
FEATURES="distlocks metadata-transfer sandbox sfperms strict test"
GENTOO_MIRRORS="http://mirrors.acm.cs.rpi.edu/gentoo http://distfiles.gentoo.org "
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/overlay"
SYNC="rsync://192.168.1.30/gentoo-portage/"
USE="acl acpi amd64 apache apache2 arts bash-completion berkdb cli contrarius cracklib cran crypt cups dbus dvdread encode evo firefox gd glsa gpm iconv inquisitio logrotate midi mmx mpeg mpeg2 mudflap mysql mysqli mythtv ncurses nfs nls nptl nptlonly ogg openmp pcre perl php png portage python qa qt3support readline reflection ruby session spl sse sse2 ssl svg tcpd test tiff unicode ups usb v4l v4l2 vfat vim-syntax xml xv zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" USERLAND="GNU" VIDEO_CARDS="via"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

[Comment 7 Chris Gianelloni (RETIRED) 2007-08-31 17:34:36 UTC]

amd64 already done by angelos

[Comment 8 Tobias Scherbaum (RETIRED) 2007-09-01 08:06:50 UTC]

ppc stable

[Comment 9 Jose Luis Rivero (yoswink) (RETIRED) 2007-09-01 19:16:35 UTC]

(In reply to comment #2)
> Updated to 2.5.4.
> 
> Please mark stable on
> 
> alpha amd64 hppa ppc ppc64 sparc x86
> 

Gunnar, when you bumped[1] the version to 2.5.4 you leave the sparc keyword as stable instead of changing to ~sparc, was it intentioned?

If it was, please tell me the reason.

If it wasn't, I will test the package to see if works fine and leave the current stable keyword (so we avoid the users to downgrade / upgrade)

Thanks.

[1] http://tinyurl.com/2qnzsd

[Comment 10 Markus Rothe (RETIRED) 2007-09-02 15:04:14 UTC]

ppc64 stable

[Comment 11 Gunnar Wrobel (RETIRED) 2007-09-03 06:26:06 UTC]

@yoswink: ups, stupid mistake of mine. sorry for that wasn't intended

[Comment 12 Jose Luis Rivero (yoswink) (RETIRED) 2007-09-03 08:38:16 UTC]

(In reply to comment #11)
> @yoswink: ups, stupid mistake of mine. sorry for that wasn't intended
> 

Nah, don't worry, you will have to pay some beers to all sparc members as punishment ;)

The program seems to run fine on sparc but I'm getting a couple of warnings in the top of the page (I will paste the details when I arrive home). Anyway, the app shows the info correctly.

Leave the sparc keyword as stable.

[Comment 13 Gunnar Wrobel (RETIRED) 2007-09-04 12:59:59 UTC]

Seems completed. I removed the insecure versions.

[Comment 14 Gunnar Wrobel (RETIRED) 2007-09-04 13:01:30 UTC]

web-apps no longer needed here :)

[Comment 15 Pierre-Yves Rofes (RETIRED) 2007-09-04 16:50:44 UTC]

time for glsa decision. low impact, I vote NO.

[Comment 16 Matt Drew (RETIRED) 2007-09-05 00:04:12 UTC]

I vote no.