phpCollab: Multiple vulnerabilities
1.
Gentoo Linux Security Advisory
Version Information
| Advisory Reference |
GLSA 200812-20 / phpcollab |
| Release Date |
December 21, 2008 |
| Latest Revision |
December 21, 2008: 01 |
| Impact |
high |
| Exploitable |
remote |
| Package |
Vulnerable versions |
Unaffected versions |
Architecture(s) |
| www-apps/phpcollab |
<=
2.5_rc3 |
|
All supported architectures
|
Related bugreports:
#235052
Synopsis
Multiple vulnerabilities have been discovered in phpCollab allowing for
remote injection of shell commands, PHP code and SQL statements.
2.
Impact Information
Background
phpCollab is a web-enabled groupware and project management software
written in PHP. It uses SQL-based database backends.
Description
Multiple vulnerabilities have been found in phpCollab:
- rgod reported that data sent to general/sendpassword.php via the
loginForm parameter is not properly sanitized before being used in an
SQL statement (CVE-2006-1495).
- Christian Hoffmann of Gentoo
Security discovered multiple vulnerabilities where input is
insufficiently sanitized before being used in an SQL statement, for
instance in general/login.php via the loginForm parameter.
(CVE-2008-4303).
- Christian Hoffmann also found out that the
variable $SSL_CLIENT_CERT in general/login.php is not properly
sanitized before being used in a shell command. (CVE-2008-4304).
- User-supplied data to installation/setup.php is not checked before
being written to include/settings.php which is executed later. This
issue was reported by Christian Hoffmann as well (CVE-2008-4305).
Impact
These vulnerabilities enable remote attackers to execute arbitrary SQL
statements and PHP code. NOTE: Some of the SQL injection
vulnerabilities require the php.ini option "magic_quotes_gpc" to be
disabled. Furthermore, an attacker might be able to execute arbitrary
shell commands if "register_globals" is enabled, "magic_quotes_gpc" is
disabled, the PHP OpenSSL extension is not installed or loaded and the
file "installation/setup.php" has not been deleted after installation.
3.
Resolution Information
Workaround
There is no known workaround at this time.
Resolution
phpCollab has been removed from the Portage tree. We recommend that
users unmerge phpCollab:
Code Listing 3.1: Resolution |
# emerge --unmerge "www-apps/phpcollab"
|
4.
References
|
