Bug 741400 (CVE-2011-3755)

Summary:	CVE-2011-3755 mantis: installation path disclosure via a direct request to a .php file
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	extras-orphan, giallu, guillaume, sven
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-03-15 04:23:21 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	741402, 800667
Bug Blocks:

Description Vincent Danen 2011-09-26 18:07:58 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2011-3755 to
the following vulnerability:

Name: CVE-2011-3755
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3755
Assigned: 20110923
Reference: http://www.openwall.com/lists/oss-security/2011/06/27/6
Reference: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README
Reference: http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/mantisbt-1.2.4

MantisBT 1.2.4 allows remote attackers to obtain sensitive information
via a direct request to a .php file, which reveals the installation
path in an error message, as demonstrated by view_all_inc.php and
certain other files.

Comment 1 Vincent Danen 2011-09-26 18:10:00 UTC

Created mantis tracking bugs for this issue

Affects: fedora-all [bug 741402]
Affects: epel-5 [bug 741403]

Comment 2 Vincent Danen 2013-03-15 04:23:21 UTC

EPEL5 hasn't been touched since Dec 2010, and the package is technically orphaned.  As a result I'm closing this bug as this issue is fixed in Fedora.  The EPEL5 tracking bug #800667 will remain open until either mantis is dropped from EPEL or it is fixed.

Fedora has 1.2.12 which is fixed.