Date: Tue, 03 Aug 2010 11:09:22 +0200 From: Joachim Fritschi <fritschi@....tu-darmstadt.de> To: oss-security@...ts.openwall.com CC: secalert@...hat.com Subject: 2 vulnerabilties in phpCAS Hi all, the phpCAS library  contains 2 security vulnerabilties that have been fixed in the new phpCAS release . Redhat already provided CVE numbers, thanks. A: CVE-2010-2795 (PHPCAS-61)  is a serious issue. It allows you to hijack any authenticated user session if get access to a users service ticket in any way. The submitted service ticket was used to rename the http session before actually validating the ticket. If you intercept or guess a service ticket you can hijack a user session without proper ticket validation. B: CVE-2010-2796 (PHPCAS-67)  is a minor issue. phpCAS is not sanatizing a submitted value. Might be usable for XSS in cas proxy mode. The phpCAS library is included in multiple other projects: glpi,moodle,tikiwiki,claroline etc. that might be vulnerable as well Regards, Joachim Fritschi  https://wiki.jasig.org/display/CASC/phpCAS  http://downloads.jasig.org/cas-clients/php/1.1.2/  https://issues.jasig.org/browse/PHPCAS-61  https://issues.jasig.org/browse/PHPCAS-67 Download attachment "smime.p7s" of type "application/pkcs7-signature" (5024 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.