Bug 1010827 (CVE-2013-5696)

Summary:	CVE-2013-5696 glpi: multiple vulnerabilities
Product:	[Other] Security Response	Reporter:	Ratul Gupta <ratulg>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	fedora
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	glpi 0.84.2	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-03-22 01:38:05 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1010831, 1010832
Bug Blocks:

Description Ratul Gupta 2013-09-23 07:01:01 UTC

GLPI, a web application designed to manage IT infrastructure, was found to have multiple vulnerabilities. An attacker could use this vulnerability to conduct SQL injection attacks or even execute arbitrary php code with the priviliges of the user running the application.
The flaw is that glpi isn't configured properly, so install.php could be executed even after the installation is completed, so the attacker could insert or edit certain commands in install.php to perform the exploits.

References:
https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerabilities-in-glpi-cve-2013-5696.html
https://forge.indepnet.net/issues/4480
https://forge.indepnet.net/projects/glpi/repository/revisions/21753/diff/branches/0.84-bugfixes/inc/central.class.php

Comment 1 Ratul Gupta 2013-09-23 07:05:36 UTC

Created glpi tracking bugs for this issue:

Affects: fedora-all [bug 1010831]
Affects: epel-all [bug 1010832]

Comment 2 Remi Collet 2013-09-23 07:17:09 UTC

While upstream have improved check in install.php, workarond and better security solution is to drop install.php file once the application is installed.

For the available RPM, the /install folder is protected, so is only allowed from local computer thus the vulnerability cannot be exploited.

While this vulnerability is considered as critical from upstream version, I think it can be considered as "very low" for RPM.

Comment 3 Vincent Danen 2013-09-23 16:46:54 UTC

The real issue is that GLPI 0.84.2 fixed the following security issues [1]:

* SQL Injection
* PHP Code Execution
* CSRF (seems that it is the vector for the SQL injection)

In addition, this CVE was noted as being originally assigned to the CSRF flaw, but was re-used for the others.  There is a posting on oss-security about a CVE split (need other CVEs for the other issues) [2].

[1] http://www.glpi-project.org/spip.php?page=annonce&id_breve=308
[2] http://www.openwall.com/lists/oss-security/2013/09/20/2

Comment 4 Fedora Update System 2013-09-27 18:41:45 UTC

glpi-0.83.9.1-4.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2013-09-27 18:43:00 UTC

glpi-0.83.9.1-4.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2013-10-12 04:30:31 UTC

glpi-0.84.2-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.