Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 181692

Summary: www-apps/phpwiki < 1.3.14 Empty LDAP Passwords Authentication Bypass (CVE-2007-3193)
Product: Gentoo Security Reporter: Lars Hartmann <lars>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal    
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: http://secunia.com/advisories/25595/
Whiteboard: B3 [glsa] p-y
Package list:
Runtime testing required: ---

Description Lars Hartmann 2007-06-11 20:41:51 UTC
A vulnerability has been reported in PhpWiki, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to an error within lib/WikiUser/LDAP.php when binding to an LDAP server with an empty password. Depending on the LDAP implementation used, this can be exploited to bypass the authentication mechanism.

The vulnerability is reported in versions prior to 1.3.13p1.

Solution:
Update to version 1.3.13p1.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
http://sourceforge.net/project/shownotes.php?release_id=514820

http://sourceforge.net/tracker/index....882&group_id=6121&atid=106121



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.

Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

Reproducible: Always
Comment 1 Lars Hartmann 2007-06-12 07:41:31 UTC
maintainers - please advice and bump as necessary
Comment 2 Lars Hartmann 2007-06-19 16:55:49 UTC
maintainers - please advice
Comment 3 Lars Hartmann 2007-07-02 18:41:50 UTC
maintainers - please advice
Comment 4 Lars Hartmann 2007-07-14 12:23:46 UTC
maintainers - please advice
Comment 5 Pierre-Yves Rofes (RETIRED) gentoo-dev 2007-07-19 08:18:11 UTC
web-apps, there's version 1.3.13_rc1 in the tree, is it the same as upstream version 1.3.13p1? And if not, does it still fix this issue?
Comment 6 Gunnar Wrobel (RETIRED) gentoo-dev 2007-08-09 10:09:32 UTC
Sorry for the delay again. I checked in 1.3.13_rc1 and removed the problematic UpLoad.php. So 1.3.13_r1 should be without the issue.

Today I also checked in 1.3.14 and verified that the code in UpLoad.php has been fixed. 

My preference would be to stabilize 1.3.14 and remove all older ebuild.
Comment 7 Gunnar Wrobel (RETIRED) gentoo-dev 2007-08-09 10:20:55 UTC
Well, i confused this with bug #174451. But the security issue mentioned here has also been fixed in 1.3.14. 
Comment 8 Pierre-Yves Rofes (RETIRED) gentoo-dev 2007-08-09 11:14:16 UTC
Thanks Gunnar. fixing severity since some arches were stable.
Arches (or should I say ppc :) please test and mark stable www-apps/phpwiki-1.3.14. Target keywords are: "ppc ~sparc ~x86 ~amd64"
Comment 9 Tobias Scherbaum (RETIRED) gentoo-dev 2007-08-14 18:14:43 UTC
ppc stable, ready for glsa voting.
Comment 10 Pierre-Yves Rofes (RETIRED) gentoo-dev 2007-08-14 18:51:46 UTC
I tend to vote YES.
Comment 11 Matt Fleming (RETIRED) gentoo-dev 2007-08-14 19:55:35 UTC
I vote YES
Comment 12 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2007-08-14 20:02:14 UTC
I tend to vote NO.
Comment 13 Gunnar Wrobel (RETIRED) gentoo-dev 2007-09-04 13:01:05 UTC
web-apps no longer needed here :)
Comment 14 Matt Drew (RETIRED) gentoo-dev 2007-09-04 23:34:12 UTC
I'll vote yes - adding request.
Comment 15 Matt Drew (RETIRED) gentoo-dev 2007-09-04 23:42:14 UTC
CVE-2007-3193
Comment 16 Raphael Marichez (Falco) (RETIRED) gentoo-dev 2007-09-18 21:40:26 UTC
it's GLSA 200709-10, sorry for the delay.