Package: lwat Version: 0.13-1 Severity: grave Tags: security I tested today lwat if there is it is vulnerable for malicious html code if this values are already inside the ldap database.
I used ldif to add something like this as the cn: cn: </a><a href="javascript:;" onclick="window.alert('Thanks for this hack');" >Test User</a><a> The result was that if I search for Test user and click on it I got a popup with 'Thanks for this hack' in it. This issue is similiar to: #415379 I will attach a fix soon, and will upload it then, since I'm the maintainer of this package ;-) Greetings Patrick -- System Information: Debian Release: 4.0 APT prefers unstable APT policy: (500, 'unstable'), (1, 'experimental') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.6.18 Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) Versions of packages lwat depends on: ii apache2-mpm-prefork [apache2] 2.2.3-3.3 Traditional model for Apache HTTPD ii debconf [debconf-2.0] 1.5.13 Debian configuration management sy ii libapache2-mod-php5 5.2.0-10 server-side, HTML-embedded scripti ii php5 5.2.0-10 server-side, HTML-embedded scripti ii php5-ldap 5.2.0-10 LDAP module for php5 ii smarty-gettext 1.0b1-2 provides gettext support for smart lwat recommends no packages. -- debconf information excluded -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]