Bug 85567 - [maintainer] net/phpldapadmin -- security update to 0.9.7-alpha6
Summary: [maintainer] net/phpldapadmin -- security update to 0.9.7-alpha6
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Only Me
Assignee: Simon L. B. Nielsen
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-09-01 14:00 UTC by Matthew Seaman
Modified: 2005-09-01 22:31 UTC (History)
1 user (show)

See Also:

Attachments
phpldapadmin.diff (1002 bytes, patch)
2005-09-01 14:00 UTC, Matthew Seaman 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Matthew Seaman 2005-09-01 14:00:39 UTC 
Security update to version 0.9.7-alpha6 which closes the
vulnerabilities mentioned in:

    http://secunia.com/advisories/16617/
    http://secunia.com/advisories/16611/

(16617 in particular allows remote access to arbitrary files on the
web server or uploading files from an arbitrary location and executing
them in the context of the PHP interpreter in the httpd.  Nasty.)

The following patches can be applied as a workaround if you don't want
to upgrade from 0.9.6c just yet:

    http://cvs.sourceforge.net/viewcvs.py/phpldapadmin/phpldapadmin/login.php?r1=1.45&r2=1.46
    http://cvs.sourceforge.net/viewcvs.py/phpldapadmin/phpldapadmin/welcome.php?r1=1.20&r2=1.21
Comment 1 Simon L. B. Nielsen freebsd_committer freebsd_triage 2005-09-01 22:23:05 UTC 
Responsible Changed
From-To: freebsd-ports-bugs->simon

Grab security update.
Comment 2 Simon L. B. Nielsen freebsd_committer freebsd_triage 2005-09-01 22:30:23 UTC 
State Changed
From-To: open->closed

Committed, thanks! 

Also thanks for the secteam heads-up - I will try to get the issue 
documented as soon as possible.