Bug 80578 – www-apps/mambo: Global Variables Security Bypass Vulnerability

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Luke Macken (RETIRED) 2005-02-03 06:50:26 UTC]

TITLE:
Mambo Global Variables Security Bypass Vulnerability

SECUNIA ADVISORY ID:
SA14124

VERIFY ADVISORY:
http://secunia.com/advisories/14124/

CRITICAL:
Moderately critical

IMPACT:
Security Bypass

WHERE:
>From remote

SOFTWARE:
Mambo 4.x
http://secunia.com/product/872/

DESCRIPTION:
A vulnerability has been reported in Mambo, which can be exploited by
malicious people to bypass certain security restrictions.

The problem is that global variables are not properly protected. This
can be exploited to gain administrative privileges and access the
database.

The vulnerability has been reported in version 4.5.1 and prior.

SOLUTION:
Apply patch for version 4.5 and 4.5.1.
http://www.mamboportal.com/component/option,com_remository/Itemid,46/

PROVIDED AND/OR DISCOVERED BY:
Reported by vendor.

ORIGINAL ADVISORY:
http://www.mamboportal.com/content/view/2008/2/

[Comment 1 Luke Macken (RETIRED) 2005-02-03 06:52:24 UTC]

Security patches can be found: http://mamboforge.net/frs/?group_id=5

web-apps, please bump to 4.5.1b or apply patches to the current version that is in portage (4.5).

[Comment 2 Aaron Walker (RETIRED) 2005-02-10 09:26:38 UTC]

4.5-r1 is in cvs; 4.5 removed. No archs are currently stable.

[Comment 3 Luke Macken (RETIRED) 2005-02-10 09:57:53 UTC]

Thanks Aaron.  

This package was never marked stable on any archs; closing without GLSA.