exploit the possibilities

Mandriva Linux Security Advisory 2011-163

Mandriva Linux Security Advisory 2011-163
Posted Nov 2, 2011
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2011-163 - Multiple vulnerabilities was discovered and corrected in phpldapadmin. Input appended to the URL in cmd.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in the context of an affected site. Input passed to the orderby parameter in cmd.php is not properly sanitised in lib/functions.php before being used in a create_function() function call. This can be exploited to inject and execute arbitrary PHP code. The updated packages have been upgraded to the latest version which is not vulnerable to these issues.

tags | advisory, arbitrary, php, vulnerability
systems | linux, mandriva
advisories | CVE-2011-4074, CVE-2011-4075
MD5 | 0a4c41d5a98d7745e9df7d7e3fadf1ed

Mandriva Linux Security Advisory 2011-163

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2011:163
http://www.mandriva.com/security/
_______________________________________________________________________

Package : phpldapadmin
Date : November 2, 2011
Affected: Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities was discovered and corrected in phpldapadmin:

Input appended to the URL in cmd.php \(when cmd is set to _debug\)
is not properly sanitised before being returned to the user. This can
be exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site (CVE-2011-4074).

Input passed to the orderby parameter in cmd.php \(when cmd is set
to query_engine, query is set to none, and search is set to e.g. 1\)
is not properly sanitised in lib/functions.php before being used in
a create_function() function call. This can be exploited to inject
and execute arbitrary PHP code (CVE-2011-4075).

The updated packages have been upgraded to the latest version (1.2.2)
which is not vulnerable to these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4074
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4075
_______________________________________________________________________

Updated Packages:

Mandriva Enterprise Server 5:
aa5dbb658ad22b4444c9d96ebf5ab78e mes5/i586/phpldapadmin-1.2.2-0.1mdvmes5.2.noarch.rpm
0d59873f81f0d993591b4037514768f2 mes5/SRPMS/phpldapadmin-1.2.2-0.1mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
81cdc948bada750eb85795dd4c274c9b mes5/x86_64/phpldapadmin-1.2.2-0.1mdvmes5.2.noarch.rpm
0d59873f81f0d993591b4037514768f2 mes5/SRPMS/phpldapadmin-1.2.2-0.1mdvmes5.2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFOsQfumqjQ0CJFipgRAhleAJwJkSZR2Gn5Q6ABBvhLZbN8QNPCJACdEYE6
grZOe//V54FQwvoQmiF3a70=
=A9qX
-----END PGP SIGNATURE-----

Login or Register to add favorites

File Archive:

August 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    3 Files
  • 2
    Aug 2nd
    2 Files
  • 3
    Aug 3rd
    32 Files
  • 4
    Aug 4th
    22 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    6 Files
  • 8
    Aug 8th
    0 Files
  • 9
    Aug 9th
    0 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close