| Summary: | www-apps/phprojekt: critical error in setup.php allows to upload and start arbitrary scripts | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Carsten Lohrke (RETIRED) <carlo> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | web-apps |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| Whiteboard: | B1 [glsa] vorlon | ||
| Package list: | Runtime testing required: | --- | |
|
Description
Carsten Lohrke (RETIRED)
2004-12-01 05:24:19 UTC
web-apps pls provide an updated ebuild rating this B1 for now, if it really allows to upload and execute scripts with the rights of the user running the webserver carlo, web-apps, can you confirm that? According to http://www.heise.de/security/news/meldung/53813 (German), this allows to upload and run any PHP-script with the standard test account. Furthermore it's said to be able to get the database password even without making use of the test account. All versions of PHProjekt seem to be affected. Btw, it.sec <http://www.it-sec.de/> who reported this (or Martin M According to http://www.heise.de/security/news/meldung/53813 (German), this allows to upload and run any PHP-script with the standard test account. Furthermore it's said to be able to get the database password even without making use of the test account. All versions of PHProjekt seem to be affected. Btw, it.sec <http://www.it-sec.de/> who reported this (or Martin Münch of it.sec), are linking to the article mentioned above. Um, I wasn't 100% correct. I read here http://www.heise.de/newsticker/meldung/53813 about it. It's said, that it's possible to load and start arbitrary php-scripts via the test account and to obtain the db password w/o any account. I guess that the latter is possible locally only, but I won't install and test phprojekt. The information from the phprojekt guys isn't very helpful, too. According to the phprojekt website this seems to allow unauthorized changes to the configuration, which, according to heise, could then allow uploading and execution of scripts using the default test account. The tarball on their site seems to have the updated setup.php included already, our distfile mirrors are spreading the vulnerable version. http://securitytracker.com/alerts/2004/Dec/1012369.html http://secunia.com/advisories/13355/ _______ web-apps, pls verify and provide a fixed ebuild asap This bug has been opened nearly a week ago. phprojekt-4.2-r1 is now in the tree. Sorry for the delay. Best regards Stu archs, please mark phprojekt-4.2-r1 stable. stable on ppc x86 stable GLSA sent, but lists are slow as hell, I didn't even received the gentoo-announce feedback... Probably will commit the mail tomorrow so please be patient. Reposted... now it works. GLSA 200412-06 |