phpCollab: Multiple vulnerabilities

Security Team Contact Address

Updated December 21, 2008

1. Gentoo Linux Security Advisory

Advisory Reference	GLSA 200812-20 / phpcollab
Release Date	December 21, 2008
Latest Revision	December 21, 2008: 01
Impact	high
Exploitable	remote

Package	Vulnerable versions	Unaffected versions	Architecture(s)
www-apps/phpcollab	<= 2.5_rc3		All supported architectures

Related bugreports: #235052

Synopsis

Multiple vulnerabilities have been discovered in phpCollab allowing for remote injection of shell commands, PHP code and SQL statements.

2. Impact Information

Background

phpCollab is a web-enabled groupware and project management software written in PHP. It uses SQL-based database backends.

Description

Multiple vulnerabilities have been found in phpCollab:

rgod reported that data sent to general/sendpassword.php via the loginForm parameter is not properly sanitized before being used in an SQL statement (CVE-2006-1495).
Christian Hoffmann of Gentoo Security discovered multiple vulnerabilites where input is insufficiently sanitized before being used in an SQL statement, for instance in general/login.php via the loginForm parameter. (CVE-2008-4303).
Christian Hoffmann also found out that the variable $SSL_CLIENT_CERT in general/login.php is not properly sanitized before being used in a shell command. (CVE-2008-4304).
User-supplied data to installation/setup.php is not checked before being written to include/settings.php which is executed later. This issue was reported by Christian Hoffmann as well (CVE-2008-4305).

Impact

These vulnerabilities enable remote attackers to execute arbitrary SQL statements and PHP code. NOTE: Some of the SQL injection vulnerabilities require the php.ini option "magic_quotes_gpc" to be disabled. Furthermore, an attacker might be able to execute arbitrary shell commands if "register_globals" is enabled, "magic_quotes_gpc" is disabled, the PHP OpenSSL extension is not installed or loaded and the file "installation/setup.php" has not been deleted after installation.

3. Resolution Information

Workaround

There is no known workaround at this time.

Resolution

phpCollab has been removed from the Portage tree. We recommend that users unmerge phpCollab:

Code Listing 3.1: Resolution

# emerge --unmerge "www-apps/phpcollab"

4. References