Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-current.git;a=commitdiff;h=7984864f052b1d6c11bf41054b4137ef8b0fbc3a
commit 7984864f052b1d6c11bf41054b4137ef8b0fbc3a Author: kikadf <[email protected]> Date: Wed Apr 16 17:09:32 2014 +0200 postfixadmin-2.3.6-2-x86_64 * Fix CVE-2014-2655 diff --git a/source/network-extra/postfixadmin/CVE-2014-2655.patch b/source/network-extra/postfixadmin/CVE-2014-2655.patch new file mode 100644 index 0000000..9ec1297 --- /dev/null +++ b/source/network-extra/postfixadmin/CVE-2014-2655.patch @@ -0,0 +1,17 @@ +Description: SECURITY: fix SQL injection in show_gen_status() + This vulnerability is only exploitable by authenticated users + able to create new aliases. If the alias contains SQL code, the + list-virtual.php overview triggers the vulnerability. +Origin: backport, http://sourceforge.net/p/postfixadmin/code/1650 +Applied-Upstream: 2.3.7 +--- a/functions.inc.php ++++ b/functions.inc.php +@@ -2175,6 +2175,8 @@ + global $CONF, $table_alias; + $stat_string = ""; + ++ $show_alias = escape_string($show_alias); ++ + $stat_goto = ""; + $stat_result = db_query ("SELECT goto FROM $table_alias WHERE address='$show_alias'"); + if ($stat_result['rows'] > 0) diff --git a/source/network-extra/postfixadmin/FrugalBuild b/source/network-extra/postfixadmin/FrugalBuild index 849cfb0..81bcae5 100644 --- a/source/network-extra/postfixadmin/FrugalBuild +++ b/source/network-extra/postfixadmin/FrugalBuild @@ -3,7 +3,7 @@ pkgname=postfixadmin pkgver=2.3.6 -pkgrel=1 +pkgrel=2 pkgdesc="web-based management tool for postfix" rodepends=('postfix>=2.0' 'apache>=1.3.27' 'php>=5.0' 'mysql>=5.0') groups=('network-extra') @@ -15,10 +15,18 @@ up2date="lynx -dump http://sourceforge.net/projects/postfixadmin/ | grep 'Downlo backup=('var/www/postfixadmin/config.inc.php' \ 'var/www/postfixadmin/motd.txt' \ 'var/www/postfixadmin/motd-users.txt') +sha1sums=('63c891865f3adcadddd44eeac460f87b8060ac7a' \ + 'bd08cb4289798385a2b4a71433377dedda9e8e6e') + +# FSA fix *** +source=(${source[@]} CVE-2014-2655.patch) +sha1sums=(${sha1sums[@]} '6d749b51f4dad11b8ab97827e296070d16e062cf') +# *********** build() { Fcd "" + Fpatchall Fmkdir /var/www Fsed "CONF\['postfix_admin_url'\] = '';" "CONF['postfix_admin_url'] = 'http://change-this-to-your.domain.tld/postfixadmin';" config.inc.php # Fsed "CONF\['postfix_admin_path'\] = '';" "CONF['postfix_admin_path'] = '/var/www/postfixadmin';" config.inc.php @@ -34,5 +42,3 @@ build() # chmod 640 $Fdestdir/var/www/$pkgname/users/*.php } -sha1sums=('63c891865f3adcadddd44eeac460f87b8060ac7a' \ - 'bd08cb4289798385a2b4a71433377dedda9e8e6e') _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
