GLSA 200412-06: PHProjekt: setup.php vulnerability

http://security.gentoo.org/

Severity:	normal
Title:	PHProjekt: setup.php vulnerability
Date:	12/10/2004
Bugs:	#73021
ID:	200412-06

Synopsis

PHProjekt contains a vulnerability in the setup procedure allowing remote users without admin rights to change the configuration.

Background

PHProjekt is a modular groupware web application used to coordinate group activities and share files.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
www-apps/phprojekt	< 4.2-r1	>= 4.2-r1	All supported architectures

Description

Martin Muench, from it.sec, found a flaw in the setup.php file.

Impact

Successful exploitation of the flaw allows a remote attacker without admin rights to make unauthorized changes to PHProjekt configuration.

Workaround

As a workaround, you could replace the existing setup.php file in PHProjekt root directory by the one provided on the PHProjekt Advisory (see References).

Resolution

All PHProjekt users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=www-apps/phprojekt-4.2-r1"

References

PHProjekt Advisory

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200412-06.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.