Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
security [2010/01/06 18:23]
greg
security [2010/04/07 18:12] (current)
Line 1: Line 1:
 ===Security Vulnerabilities=== ===Security Vulnerabilities===
  
 +==2010:0317 >> disabling Sahana security ACL via stream module ==
 +
 +Ability to completely disable authentication via stream.php and commented
 +out module authentication code within it.
 +
 +http://sahana/index.php?mod=admin&act=acl_enable_acl Authenticates correctly. \\
 +http://sahana/stream.php?mod=admin&act=acl_enable_acl Does not.
 +
 +The patch for this vulnerability disallow the streaming module from disabling the Sahana ACL.
 +
 +Code Commits:\\
 +trunk >> http://bazaar.launchpad.net/~sahana-php/s3/php-cvs-trunk/revision/4531 \\
 +rel_0_6 >> http://bazaar.launchpad.net/~sahana-php/s3/php-cvs-stable/revision/3798 \\
 +\\
 +\\
 +\\
 +\\
 +\\
 ==2009:1210 >> mod variable exploits in lib_locale == ==2009:1210 >> mod variable exploits in lib_locale ==
  
Line 12: Line 30:
   http://sahana/index.php?mod="'><IMG%20SRC="http://www.google.com/logos/newton10-tree.jpg">&act=lc_set    http://sahana/index.php?mod="'><IMG%20SRC="http://www.google.com/logos/newton10-tree.jpg">&act=lc_set 
  
-No patch has yet been created to resolve these issues.+The patch to this vulnerability cleanses the mod variable in lib_locale by making sure it meets the regular expression for a module's folder structure as noted here: http://wiki.sahana.lk/doku.php/dev:php_coding_convention#choosing_a_name_for_a_module_in_sahana_module
  
 Code commits:\\ Code commits:\\
-rel_0_6 >> http://sahana.cvs.sourceforge.net/viewvc/sahana/sahana-phase2/inc/lib_locale/lib_locale.inc?revision=1.23.2.5&view=markup \\ +rel_0_6 >> http://sahana.cvs.sourceforge.net/viewvc/sahana/sahana-phase2/inc/lib_locale/lib_locale.inc?r1=1.23.2.4&r2=1.23.2.5 \\ 
-trunk >> http://sahana.cvs.sourceforge.net/viewvc/sahana/sahana-phase2/inc/lib_locale/lib_locale.inc?revision=1.30&view=markup \\ +trunk >> http://sahana.cvs.sourceforge.net/viewvc/sahana/sahana-phase2/inc/lib_locale/lib_locale.inc?r1=1.29&r2=1.30 \\ 
- +\\ 
- +\\ 
 +\\ 
 +\\ 
 +\\
 ==2009:1029-2 >> MPR Module Exploits== ==2009:1029-2 >> MPR Module Exploits==
  
Line 36: Line 56:
 rel_0_6 >> http://sahana.cvs.sourceforge.net/viewvc/sahana/sahana-phase2/mod/mpr/search.inc?revision=1.17.24.8&view=markup \\ rel_0_6 >> http://sahana.cvs.sourceforge.net/viewvc/sahana/sahana-phase2/mod/mpr/search.inc?revision=1.17.24.8&view=markup \\
 trunk >> http://sahana.cvs.sourceforge.net/viewvc/sahana/sahana-phase2/mod/mpr/search.inc?revision=1.31&view=markup \\ trunk >> http://sahana.cvs.sourceforge.net/viewvc/sahana/sahana-phase2/mod/mpr/search.inc?revision=1.31&view=markup \\
- +\\ 
- +\\ 
 +\\ 
 +\\ 
 +\\
 ==2009:1029-1 >> Session Fixation Exploit== ==2009:1029-1 >> Session Fixation Exploit==
  
Line 53: Line 75:
 rel_0_6 >> http://sahana.cvs.sourceforge.net/viewvc/sahana/sahana-phase2/inc/lib_session/handler_session.inc?revision=1.12.4.1&view=markup\\ rel_0_6 >> http://sahana.cvs.sourceforge.net/viewvc/sahana/sahana-phase2/inc/lib_session/handler_session.inc?revision=1.12.4.1&view=markup\\
 trunk >> http://sahana.cvs.sourceforge.net/viewvc/sahana/sahana-phase2/inc/lib_session/handler_session.inc?revision=1.16&view=markup\\ trunk >> http://sahana.cvs.sourceforge.net/viewvc/sahana/sahana-phase2/inc/lib_session/handler_session.inc?revision=1.16&view=markup\\
- +\\ 
 +\\ 
 +\\ 
 +\\ 
 +\\
 ==2009:1019 >> Null character URL Exploit== ==2009:1019 >> Null character URL Exploit==
  

Navigation
QR Code
QR Code security (generated for current page)