Hi, Giuseppe Iuculano ha scritto: > Hi, > > Nico Golde ha scritto: >> I take care of sponsoring the upload for unstable. For >> stable security the version looks wrong to me, please use >> 4.0.1-3.1etch1. > > Right, attached the new debdiff. > > Giuseppe. >
Attached a new proposed debdiff to fix also #427151, #449103 (CVE-2007-2865, CVE-2007-5728) in stable. Giuseppe.
diff -u phppgadmin-4.0.1/debian/changelog phppgadmin-4.0.1/debian/changelog --- phppgadmin-4.0.1/debian/changelog +++ phppgadmin-4.0.1/debian/changelog @@ -1,3 +1,15 @@ +phppgadmin (4.0.1-3.1etch1) stable-security; urgency=high + + * Non-maintainer upload. + * debian/patches/01_CVE-2008-5587.dpatch: Unset language variable before + determine file includes (Closes: #508026), and fix local file inclusion + vulnerability (CVE-2008-5587) + * debian/patches/02_CVE-2007-2865_CVE-2007-5728.dpatch: Backported upstream + patch to fix XSS vulnerability (Closes: #427151) (Closes: #449103) + (CVE-2007-2865, CVE-2007-5728) + + -- Giuseppe Iuculano <[email protected]> Tue, 23 Dec 2008 18:19:59 +0100 + phppgadmin (4.0.1-3.1) unstable; urgency=low * Non-maintainer upload to fix pending l10n issues. only in patch2: unchanged: --- phppgadmin-4.0.1.orig/debian/patches/02_CVE-2007-2865_CVE-2007-5728.dpatch +++ phppgadmin-4.0.1/debian/patches/02_CVE-2007-2865_CVE-2007-5728.dpatch @@ -0,0 +1,394 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## 02_CVE-2007-2865_CVE-2007-5728.dpatch by Giuseppe Iuculano <[email protected]> +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: backport XSS vulnerability fixes (CVE-2007-2865,CVE-2007-5728) + +...@dpatch@ +diff -urNad phppgadmin-4.0.1~/all_db.php phppgadmin-4.0.1/all_db.php +--- phppgadmin-4.0.1~/all_db.php 2005-10-18 05:45:15.000000000 +0200 ++++ phppgadmin-4.0.1/all_db.php 2008-12-23 18:13:36.000000000 +0100 +@@ -11,7 +11,6 @@ + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; + if (!isset($msg)) $msg = ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Display a form for alter and perform actual alter +diff -urNad phppgadmin-4.0.1~/casts.php phppgadmin-4.0.1/casts.php +--- phppgadmin-4.0.1~/casts.php 2005-10-18 05:45:15.000000000 +0200 ++++ phppgadmin-4.0.1/casts.php 2008-12-23 18:13:36.000000000 +0100 +@@ -11,7 +11,6 @@ + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; + if (!isset($msg)) $msg = ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Show default list of casts in the database +diff -urNad phppgadmin-4.0.1~/constraints.php phppgadmin-4.0.1/constraints.php +--- phppgadmin-4.0.1~/constraints.php 2005-10-18 05:45:15.000000000 +0200 ++++ phppgadmin-4.0.1/constraints.php 2008-12-23 18:13:36.000000000 +0100 +@@ -11,7 +11,6 @@ + include_once('./classes/class.select.php'); + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Confirm and then actually add a FOREIGN KEY constraint +diff -urNad phppgadmin-4.0.1~/conversions.php phppgadmin-4.0.1/conversions.php +--- phppgadmin-4.0.1~/conversions.php 2005-10-18 05:45:15.000000000 +0200 ++++ phppgadmin-4.0.1/conversions.php 2008-12-23 18:13:36.000000000 +0100 +@@ -11,7 +11,6 @@ + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; + if (!isset($msg)) $msg = ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Show default list of conversions in the database +diff -urNad phppgadmin-4.0.1~/database.php phppgadmin-4.0.1/database.php +--- phppgadmin-4.0.1~/database.php 2005-11-09 10:05:58.000000000 +0100 ++++ phppgadmin-4.0.1/database.php 2008-12-23 18:13:36.000000000 +0100 +@@ -11,7 +11,6 @@ + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; + if (!isset($msg)) $msg = ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + function _highlight($string, $term) { + return str_replace($term, "<b>{$term}</b>", $string); +diff -urNad phppgadmin-4.0.1~/dataexport.php phppgadmin-4.0.1/dataexport.php +--- phppgadmin-4.0.1~/dataexport.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/dataexport.php 2008-12-23 18:13:26.000000000 +0100 +@@ -307,7 +307,7 @@ + $misc->printTitle($lang['strexport']); + if (isset($msg)) $misc->printMsg($msg); + +- echo "<form action=\"{$_SERVER['PHP_SELF']}\" method=\"post\">\n"; ++ echo "<form action=\"{$PHP_SELF}\" method=\"post\">\n"; + echo "<table>\n"; + echo "<tr><th class=\"data\">{$lang['strformat']}:</th><td><select name=\"d_format\">\n"; + // COPY and SQL require a table +diff -urNad phppgadmin-4.0.1~/display.php phppgadmin-4.0.1/display.php +--- phppgadmin-4.0.1~/display.php 2005-11-20 04:07:26.000000000 +0100 ++++ phppgadmin-4.0.1/display.php 2008-12-23 18:13:36.000000000 +0100 +@@ -21,7 +21,6 @@ + global $conf, $lang; + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Show confirmation of edit and perform actual update +diff -urNad phppgadmin-4.0.1~/domains.php phppgadmin-4.0.1/domains.php +--- phppgadmin-4.0.1~/domains.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/domains.php 2008-12-23 18:13:36.000000000 +0100 +@@ -11,7 +11,6 @@ + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; + if (!isset($msg)) $msg = ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Function to save after altering a domain +diff -urNad phppgadmin-4.0.1~/functions.php phppgadmin-4.0.1/functions.php +--- phppgadmin-4.0.1~/functions.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/functions.php 2008-12-23 18:13:36.000000000 +0100 +@@ -11,7 +11,6 @@ + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; + if (!isset($msg)) $msg = ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Function to save after editing a function +diff -urNad phppgadmin-4.0.1~/groups.php phppgadmin-4.0.1/groups.php +--- phppgadmin-4.0.1~/groups.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/groups.php 2008-12-23 18:13:36.000000000 +0100 +@@ -11,7 +11,6 @@ + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; + if (!isset($msg)) $msg = ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Add user to a group +diff -urNad phppgadmin-4.0.1~/indexes.php phppgadmin-4.0.1/indexes.php +--- phppgadmin-4.0.1~/indexes.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/indexes.php 2008-12-23 18:13:36.000000000 +0100 +@@ -11,7 +11,6 @@ + include_once('./classes/class.select.php'); + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Show confirmation of cluster index and perform actual cluster +diff -urNad phppgadmin-4.0.1~/info.php phppgadmin-4.0.1/info.php +--- phppgadmin-4.0.1~/info.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/info.php 2008-12-23 18:13:36.000000000 +0100 +@@ -10,7 +10,6 @@ + include_once('./libraries/lib.inc.php'); + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * List all the information on the table +diff -urNad phppgadmin-4.0.1~/intro.php phppgadmin-4.0.1/intro.php +--- phppgadmin-4.0.1~/intro.php 2005-05-02 17:47:24.000000000 +0200 ++++ phppgadmin-4.0.1/intro.php 2008-12-23 18:13:26.000000000 +0100 +@@ -19,7 +19,7 @@ + + <h1><?php echo "$appName $appVersion (PHP ". phpversion() .')' ?></h1> + +-<form method="get" action="<?php echo $_SERVER['PHP_SELF'] ?>"> ++<form method="get" action="<?php echo $PHP_SELF; ?>"> + <label> + <select name="language" onchange="this.form.submit()"> + <?php +diff -urNad phppgadmin-4.0.1~/languages.php phppgadmin-4.0.1/languages.php +--- phppgadmin-4.0.1~/languages.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/languages.php 2008-12-23 18:13:36.000000000 +0100 +@@ -11,7 +11,6 @@ + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; + if (!isset($msg)) $msg = ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Show default list of languages in the database +diff -urNad phppgadmin-4.0.1~/libraries/lib.inc.php phppgadmin-4.0.1/libraries/lib.inc.php +--- phppgadmin-4.0.1~/libraries/lib.inc.php 2008-12-23 18:13:04.000000000 +0100 ++++ phppgadmin-4.0.1/libraries/lib.inc.php 2008-12-23 18:13:36.000000000 +0100 +@@ -221,4 +221,7 @@ + } + } + ++ // Prevent XSS attacks ++ $PHP_SELF = htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, $lang['appcharset']); ++ + ?> +diff -urNad phppgadmin-4.0.1~/login.php phppgadmin-4.0.1/login.php +--- phppgadmin-4.0.1~/login.php 2005-11-19 10:14:34.000000000 +0100 ++++ phppgadmin-4.0.1/login.php 2008-12-23 18:13:26.000000000 +0100 +@@ -10,6 +10,8 @@ + // This needs to be an include once to prevent lib.inc.php infinite recursive includes. + // Check to see if the configuration file exists, if not, explain + require_once('./libraries/lib.inc.php'); ++ ++ global $PHP_SELF; + + $misc->printHeader($lang['strlogin']); + $misc->printBody(); +@@ -22,7 +24,7 @@ + if (isset($msg)) $misc->printMsg($msg); + ?> + +-<form action="<?php echo $_SERVER['PHP_SELF'] ?>" method="post" name="login_form"> ++<form action="<?php echo $PHP_SELF ?>" method="post" name="login_form"> + <?php + if (!empty($_POST)) $vars =& $_POST; + else $vars =& $_GET; +diff -urNad phppgadmin-4.0.1~/operators.php phppgadmin-4.0.1/operators.php +--- phppgadmin-4.0.1~/operators.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/operators.php 2008-12-23 18:13:36.000000000 +0100 +@@ -11,7 +11,6 @@ + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; + if (!isset($msg)) $msg = ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Show read only properties for an operator +diff -urNad phppgadmin-4.0.1~/plugin_slony.php phppgadmin-4.0.1/plugin_slony.php +--- phppgadmin-4.0.1~/plugin_slony.php 2005-11-09 10:05:58.000000000 +0100 ++++ phppgadmin-4.0.1/plugin_slony.php 2008-12-23 18:13:36.000000000 +0100 +@@ -20,7 +20,6 @@ + include_once('./libraries/lib.inc.php'); + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + // Include 'slony_cluster' in $misc->href if present + if (isset($_REQUEST['slony_cluster'])) { +diff -urNad phppgadmin-4.0.1~/privileges.php phppgadmin-4.0.1/privileges.php +--- phppgadmin-4.0.1~/privileges.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/privileges.php 2008-12-23 18:13:36.000000000 +0100 +@@ -11,7 +11,6 @@ + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; + if (!isset($msg)) $msg = ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Grant permissions on an object to a user +diff -urNad phppgadmin-4.0.1~/reports.php phppgadmin-4.0.1/reports.php +--- phppgadmin-4.0.1~/reports.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/reports.php 2008-12-23 18:13:36.000000000 +0100 +@@ -10,7 +10,6 @@ + include_once('./libraries/lib.inc.php'); + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Displays a screen where they can edit a report +diff -urNad phppgadmin-4.0.1~/rules.php phppgadmin-4.0.1/rules.php +--- phppgadmin-4.0.1~/rules.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/rules.php 2008-12-23 18:13:36.000000000 +0100 +@@ -10,7 +10,6 @@ + include_once('./libraries/lib.inc.php'); + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Confirm and then actually create a rule +diff -urNad phppgadmin-4.0.1~/schemas.php phppgadmin-4.0.1/schemas.php +--- phppgadmin-4.0.1~/schemas.php 2005-10-18 06:00:19.000000000 +0200 ++++ phppgadmin-4.0.1/schemas.php 2008-12-23 18:13:36.000000000 +0100 +@@ -11,7 +11,6 @@ + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; + if (!isset($msg)) $msg = ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Show default list of schemas in the database +diff -urNad phppgadmin-4.0.1~/sequences.php phppgadmin-4.0.1/sequences.php +--- phppgadmin-4.0.1~/sequences.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/sequences.php 2008-12-23 18:13:36.000000000 +0100 +@@ -11,7 +11,6 @@ + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; + if (!isset($msg)) $msg = ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Display list of all sequences in the database/schema +diff -urNad phppgadmin-4.0.1~/servers.php phppgadmin-4.0.1/servers.php +--- phppgadmin-4.0.1~/servers.php 2005-10-18 06:00:19.000000000 +0200 ++++ phppgadmin-4.0.1/servers.php 2008-12-23 18:13:36.000000000 +0100 +@@ -12,7 +12,6 @@ + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; + if (!isset($msg)) $msg = ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + function doLogout() { + global $misc, $lang, $_reload_browser; +diff -urNad phppgadmin-4.0.1~/sql.php phppgadmin-4.0.1/sql.php +--- phppgadmin-4.0.1~/sql.php 2005-06-16 16:40:11.000000000 +0200 ++++ phppgadmin-4.0.1/sql.php 2008-12-23 18:13:36.000000000 +0100 +@@ -87,8 +87,6 @@ + exit; + } + +- $PHP_SELF = $_SERVER['PHP_SELF']; +- + $misc->printHeader($lang['strqueryresults']); + $misc->printBody(); + $misc->printTrail('database'); +diff -urNad phppgadmin-4.0.1~/sqledit.php phppgadmin-4.0.1/sqledit.php +--- phppgadmin-4.0.1~/sqledit.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/sqledit.php 2008-12-23 18:13:36.000000000 +0100 +@@ -11,7 +11,6 @@ + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; + if (!isset($msg)) $msg = ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Private function to display server and list of databases +diff -urNad phppgadmin-4.0.1~/tables.php phppgadmin-4.0.1/tables.php +--- phppgadmin-4.0.1~/tables.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/tables.php 2008-12-23 18:13:36.000000000 +0100 +@@ -10,7 +10,6 @@ + include_once('./libraries/lib.inc.php'); + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Displays a screen where they can enter a new table +diff -urNad phppgadmin-4.0.1~/tablespaces.php phppgadmin-4.0.1/tablespaces.php +--- phppgadmin-4.0.1~/tablespaces.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/tablespaces.php 2008-12-23 18:13:36.000000000 +0100 +@@ -11,7 +11,6 @@ + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; + if (!isset($msg)) $msg = ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Function to allow altering of a tablespace +diff -urNad phppgadmin-4.0.1~/tblproperties.php phppgadmin-4.0.1/tblproperties.php +--- phppgadmin-4.0.1~/tblproperties.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/tblproperties.php 2008-12-23 18:13:36.000000000 +0100 +@@ -10,7 +10,6 @@ + include_once('./libraries/lib.inc.php'); + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Function to save after altering a table +diff -urNad phppgadmin-4.0.1~/triggers.php phppgadmin-4.0.1/triggers.php +--- phppgadmin-4.0.1~/triggers.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/triggers.php 2008-12-23 18:13:36.000000000 +0100 +@@ -11,7 +11,6 @@ + include_once('./classes/class.select.php'); + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Function to save after altering a trigger +diff -urNad phppgadmin-4.0.1~/types.php phppgadmin-4.0.1/types.php +--- phppgadmin-4.0.1~/types.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/types.php 2008-12-23 18:13:36.000000000 +0100 +@@ -11,7 +11,6 @@ + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; + if (!isset($msg)) $msg = ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Show read only properties for a type +diff -urNad phppgadmin-4.0.1~/users.php phppgadmin-4.0.1/users.php +--- phppgadmin-4.0.1~/users.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/users.php 2008-12-23 18:13:36.000000000 +0100 +@@ -11,7 +11,6 @@ + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; + if (!isset($msg)) $msg = ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * If a user is not a superuser, then we have an 'account management' page +diff -urNad phppgadmin-4.0.1~/viewproperties.php phppgadmin-4.0.1/viewproperties.php +--- phppgadmin-4.0.1~/viewproperties.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/viewproperties.php 2008-12-23 18:13:36.000000000 +0100 +@@ -10,7 +10,6 @@ + include_once('./libraries/lib.inc.php'); + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Function to save after editing a view +diff -urNad phppgadmin-4.0.1~/views.php phppgadmin-4.0.1/views.php +--- phppgadmin-4.0.1~/views.php 2005-10-18 05:45:16.000000000 +0200 ++++ phppgadmin-4.0.1/views.php 2008-12-23 18:13:36.000000000 +0100 +@@ -12,7 +12,6 @@ + + $action = (isset($_REQUEST['action'])) ? $_REQUEST['action'] : ''; + if (!isset($msg)) $msg = ''; +- $PHP_SELF = $_SERVER['PHP_SELF']; + + /** + * Ask for select parameters and perform select only in patch2: unchanged: --- phppgadmin-4.0.1.orig/debian/patches/00list +++ phppgadmin-4.0.1/debian/patches/00list @@ -0,0 +1,2 @@ +01_CVE-2008-5587.dpatch +02_CVE-2007-2865_CVE-2007-5728.dpatch only in patch2: unchanged: --- phppgadmin-4.0.1.orig/debian/patches/01_CVE-2008-5587.dpatch +++ phppgadmin-4.0.1/debian/patches/01_CVE-2008-5587.dpatch @@ -0,0 +1,19 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## 01_CVE-2008-5587.dpatch by Giuseppe Iuculano <[email protected]> +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: Unset language variable before determine file includes (CVE-2008-5587) + +...@dpatch@ +diff -urNad phppgadmin-4.0.1~/libraries/lib.inc.php phppgadmin-4.0.1/libraries/lib.inc.php +--- phppgadmin-4.0.1~/libraries/lib.inc.php 2005-11-23 05:31:10.000000000 +0100 ++++ phppgadmin-4.0.1/libraries/lib.inc.php 2008-12-23 18:10:04.000000000 +0100 +@@ -94,6 +94,8 @@ + } + + // Determine language file to import: ++ unset($_language); ++ + // 1. Check for the language from a request var + if (isset($_REQUEST['language']) && isset($appLangFiles[$_REQUEST['language']])) + $_language = $_REQUEST['language'];
signature.asc
Description: OpenPGP digital signature
