Bug 456044 - (CVE-2008-3333) CVE-2008-3333 mantis: arbitrary file inclusion through user preferences page
CVE-2008-3333 mantis: arbitrary file inclusion through user preferences page
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
reported=20080721,public=20080617
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-07-21 03:43 EDT by Tomas Hoger
Modified: 2008-07-28 04:56 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-07-28 04:56:01 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Tomas Hoger 2008-07-21 03:43:51 EDT
New upstream Mantis version 1.1.2 fixes following security issue:

- 0009154: [security] arbitrary file inclusion through user preferences page
(giallu) - closed.

  http://www.mantisbt.org/bugs/changelog_page.php

Upstream bug report:

  http://www.mantisbt.org/bugs/view.php?id=9154

  Vulnerability overview:
  -----------------------
  Due to unchecked user input, arbitrary files can be included within a PHP
  require_once() statement. Input length is limited to 32 characters. This
  vulnerability allows for reading arbitrary files on the affected webserver,
  as well as code execution if the attacker can put php code in any includable
  file (which is possible in most scenarios).
 

  Vulnerability description:
  --------------------------
  Vulnerable files/objects: core/lang_api.php, account_prefs_update.php

  Line 37 (in "core/lang_api.php") loads text file with user-supplied language
  preference.

  ---cut here---
  require_once( $t_lang_dir . 'strings_' . $p_lang . '.txt' );
  ---cut here---

  Proof of concept:
  -----------------
  Use account_prefs_update.php to set language to something like:

  language=urdu.txt/../../../../etc/passwd%00

Fix in upstream SVN:
http://mantisbt.svn.sourceforge.net/viewvc/mantisbt?view=rev&revision=5270
Comment 1 Fedora Update System 2008-07-23 03:20:12 EDT
mantis-1.1.2-1.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 2 Fedora Update System 2008-07-23 03:21:42 EDT
mantis-1.1.2-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 3 Tomas Hoger 2008-07-28 04:54:00 EDT
CVE-2008-3333:
Directory traversal vulnerability in core/lang_api.php in Mantis
before 1.1.2 allows remote attackers to read and include arbitrary
files via the language parameter to the user preferences page
(account_prefs_update.php).
Comment 4 Red Hat Product Security 2008-07-28 04:56:01 EDT
This issue was addressed in:

Fedora:
  https://admin.fedoraproject.org/updates/F8/FEDORA-2008-6657
  https://admin.fedoraproject.org/updates/F9/FEDORA-2008-6647


Note You need to log in before you can comment on or make changes to this bug.