oss-security - Re: CVE request - phpCAS: prevent symlink attacks, directory traversal and XSS during a proxy callback

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4CA5FA68.3090000@hrz.tu-darmstadt.de>
Date: Fri, 01 Oct 2010 17:12:40 +0200
From: Joachim Fritschi <fritschi@....tu-darmstadt.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request - phpCAS: prevent symlink attacks,
 directory traversal and XSS during a proxy callback

Can anyone please supply a CVE ?

Thanks,

Joachim

Am 29.09.2010 15:06, schrieb Joachim Fritschi:
> Reported by Raphael Geissert almost 2 years ago but never really made it
> into the upstream code:
>
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495542#82
>
> In phpCAS proxy mode the parameters submitted during a callback to the
> callback() function are not properly sanatized. The parameters are used
> as file handles for filesystem access and parameters in urls.
> This allows an attacker symlink attacks, directory traversal attacks and
> XSS attacks. The issue has been fixed and patches are available:
>
> https://issues.jasig.org/browse/PHPCAS-80
> https://developer.jasig.org/source/changelog/jasigsvn?cs=21538
>
> A new 1.1.3 release which contains the patch and various other bugfixes
> will be released within the next few days.
>
> Cheers,
>
> Joachim
>
>


-- 
Joachim Fritschi
Hochschulrechenzentrum (HRZ)
L1|01 Raum 248
Petersenstr. 30
64287 Darmstadt

Tel. +49 6151 16-5638
Fax. +49 6151 16-3050
E-Mail: fritschi@....tu-darmstadt.de


Download attachment "smime.p7s" of type "application/pkcs7-signature" (5024 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.