Re: CVE request - phpCAS: prevent symlink attacks, directory traversal and XSS during a proxy callback

[Josh Bressers <bressers () redhat com>]

Sorry for the delay:

CVE-2010-3690 phpCAS: XSS during a proxy callback
CVE-2010-3691 phpCAS: prevent symlink attacks during a proxy callback
CVE-2010-3692 phpCAS: directory traversal during a proxy callback

Thanks.

-- 
    JB


----- "Joachim Fritschi" <fritschi () hrz tu-darmstadt de> wrote:

> Reported by Raphael Geissert almost 2 years ago but never really made
> it 
> into the upstream code:
>
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495542#82
>
> In phpCAS proxy mode the parameters submitted during a callback to the
>
> callback() function are not properly sanatized. The parameters are
> used 
> as file handles for filesystem access and parameters in urls.
> This allows an attacker symlink attacks, directory traversal attacks
> and 
> XSS attacks. The issue has been fixed and patches are available:
>
> https://issues.jasig.org/browse/PHPCAS-80
> https://developer.jasig.org/source/changelog/jasigsvn?cs=21538
>
> A new 1.1.3 release which contains the patch and various other
> bugfixes 
> will be released within the next few days.
>
> Cheers,
>
> Joachim