Gentoo Logo

phpCollab: Multiple vulnerabilities

Content:

1.  Gentoo Linux Security Advisory

Version Information

Advisory Reference GLSA 200812-20 / phpcollab
Release Date December 21, 2008
Latest Revision December 21, 2008: 01
Impact high
Exploitable remote
Package Vulnerable versions Unaffected versions Architecture(s)
www-apps/phpcollab <= 2.5_rc3 All supported architectures

Related bugreports: #235052

Synopsis

Multiple vulnerabilities have been discovered in phpCollab allowing for remote injection of shell commands, PHP code and SQL statements.

2.  Impact Information

Background

phpCollab is a web-enabled groupware and project management software written in PHP. It uses SQL-based database backends.

Description

Multiple vulnerabilities have been found in phpCollab:

  • rgod reported that data sent to general/sendpassword.php via the loginForm parameter is not properly sanitized before being used in an SQL statement (CVE-2006-1495).
  • Christian Hoffmann of Gentoo Security discovered multiple vulnerabilities where input is insufficiently sanitized before being used in an SQL statement, for instance in general/login.php via the loginForm parameter. (CVE-2008-4303).
  • Christian Hoffmann also found out that the variable $SSL_CLIENT_CERT in general/login.php is not properly sanitized before being used in a shell command. (CVE-2008-4304).
  • User-supplied data to installation/setup.php is not checked before being written to include/settings.php which is executed later. This issue was reported by Christian Hoffmann as well (CVE-2008-4305).

Impact

These vulnerabilities enable remote attackers to execute arbitrary SQL statements and PHP code. NOTE: Some of the SQL injection vulnerabilities require the php.ini option "magic_quotes_gpc" to be disabled. Furthermore, an attacker might be able to execute arbitrary shell commands if "register_globals" is enabled, "magic_quotes_gpc" is disabled, the PHP OpenSSL extension is not installed or loaded and the file "installation/setup.php" has not been deleted after installation.

3.  Resolution Information

Workaround

There is no known workaround at this time.

Resolution

phpCollab has been removed from the Portage tree. We recommend that users unmerge phpCollab:

Code Listing 3.1: Resolution

# emerge --unmerge "www-apps/phpcollab"

4.  References



Print

Page updated December 21, 2008

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.

Copyright 2001-2014 Gentoo Foundation, Inc. Questions, Comments? Contact us.