Re: CVE request - phpCAS: prevent symlink attacks, directory traversal and XSS during a proxy callback

[Joachim Fritschi <fritschi () hrz tu-darmstadt de>]

Can anyone please supply a CVE ?

Thanks,

Joachim

Am 29.09.2010 15:06, schrieb Joachim Fritschi:
> Reported by Raphael Geissert almost 2 years ago but never really made it
> into the upstream code:
>
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495542#82
>
> In phpCAS proxy mode the parameters submitted during a callback to the
> callback() function are not properly sanatized. The parameters are used
> as file handles for filesystem access and parameters in urls.
> This allows an attacker symlink attacks, directory traversal attacks and
> XSS attacks. The issue has been fixed and patches are available:
>
> https://issues.jasig.org/browse/PHPCAS-80
> https://developer.jasig.org/source/changelog/jasigsvn?cs=21538
>
> A new 1.1.3 release which contains the patch and various other bugfixes
> will be released within the next few days.
>
> Cheers,
>
> Joachim


--
Joachim Fritschi
Hochschulrechenzentrum (HRZ)
L1|01 Raum 248
Petersenstr. 30
64287 Darmstadt

Tel. +49 6151 16-5638
Fax. +49 6151 16-3050
E-Mail: fritschi () hrz tu-darmstadt de

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature