[<prev] [next>] [day] [month] [year] [list]
Message-ID: <4C57DCC2.8060508@hrz.tu-darmstadt.de>
Date: Tue, 03 Aug 2010 11:09:22 +0200
From: Joachim Fritschi <fritschi@....tu-darmstadt.de>
To: oss-security@...ts.openwall.com
CC: secalert@...hat.com
Subject: 2 vulnerabilties in phpCAS
Hi all,
the phpCAS library [1] contains 2 security vulnerabilties that have been
fixed in the new phpCAS release [2]. Redhat already provided CVE
numbers, thanks.
A: CVE-2010-2795 (PHPCAS-61) [3] is a serious issue. It allows you to
hijack any authenticated user session if get access to a users service
ticket in any way. The submitted service ticket was used to rename the
http session before actually validating the ticket. If you intercept or
guess a service ticket you can hijack a user session without proper
ticket validation.
B: CVE-2010-2796 (PHPCAS-67) [4] is a minor issue. phpCAS is not
sanatizing a submitted value. Might be usable for XSS in cas proxy mode.
The phpCAS library is included in multiple other projects:
glpi,moodle,tikiwiki,claroline etc. that might be vulnerable as well
Regards,
Joachim Fritschi
[1] https://wiki.jasig.org/display/CASC/phpCAS
[2] http://downloads.jasig.org/cas-clients/php/1.1.2/
[3] https://issues.jasig.org/browse/PHPCAS-61
[4] https://issues.jasig.org/browse/PHPCAS-67
Download attachment "smime.p7s" of type "application/pkcs7-signature" (5024 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
