Date: Fri, 11 Dec 2009 12:20:13 -0600 From: Raphael Geissert <geissert@...ian.org> To: oss-security@...ts.openwall.com Subject: Re: CVE request: Argument injections in multiple PEAR packages -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Alex Legler wrote: [...] > 2. PEAR-Net_Ping < 2.4.5 ping() Argument Injection via $host > > Upstream writes: > "When input from forms are used directly, the attacker could pass > variables that would allow him to execute remote arbitrary command > injections." [...] > 3. PEAR-Net_Traceroute < 0.21.2 traceroute() Argument Injection via > $host > > See above, same advisory. The fix applied by upstream in both cases is incomplete as it only prevents the command execution vulnerability, but doesn't address the argument injection vulnerability. The appropriate fix in both cases is to use escapeshellarg instead of escapeshellcmd. Please assign new ids for the incomplete fixes. Thanks in advance. Regards, - -- Raphael Geissert - Debian Developer www.debian.org - get.debian.net -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iEYEARECAAYFAksijWIACgkQYy49rUbZzlpnqgCfcHEHuhEA68P2uLr/UvAs1mnS teEAn3zmAW+a8iYFn7bjsobk9w+BXy+P =Bshr -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.