New upstream Mantis version 1.1.2 fixes following security issue: - 0009154: [security] arbitrary file inclusion through user preferences page (giallu) - closed. http://www.mantisbt.org/bugs/changelog_page.php Upstream bug report: http://www.mantisbt.org/bugs/view.php?id=9154 Vulnerability overview: ----------------------- Due to unchecked user input, arbitrary files can be included within a PHP require_once() statement. Input length is limited to 32 characters. This vulnerability allows for reading arbitrary files on the affected webserver, as well as code execution if the attacker can put php code in any includable file (which is possible in most scenarios). Vulnerability description: -------------------------- Vulnerable files/objects: core/lang_api.php, account_prefs_update.php Line 37 (in "core/lang_api.php") loads text file with user-supplied language preference. ---cut here--- require_once( $t_lang_dir . 'strings_' . $p_lang . '.txt' ); ---cut here--- Proof of concept: ----------------- Use account_prefs_update.php to set language to something like: language=urdu.txt/../../../../etc/passwd%00 Fix in upstream SVN: http://mantisbt.svn.sourceforge.net/viewvc/mantisbt?view=rev&revision=5270
mantis-1.1.2-1.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
mantis-1.1.2-1.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
CVE-2008-3333: Directory traversal vulnerability in core/lang_api.php in Mantis before 1.1.2 allows remote attackers to read and include arbitrary files via the language parameter to the user preferences page (account_prefs_update.php).
This issue was addressed in: Fedora: https://admin.fedoraproject.org/updates/F8/FEDORA-2008-6657 https://admin.fedoraproject.org/updates/F9/FEDORA-2008-6647