GLPI, a web application designed to manage IT infrastructure, was found to have multiple vulnerabilities. An attacker could use this vulnerability to conduct SQL injection attacks or even execute arbitrary php code with the priviliges of the user running the application. The flaw is that glpi isn't configured properly, so install.php could be executed even after the installation is completed, so the attacker could insert or edit certain commands in install.php to perform the exploits. References: https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerabilities-in-glpi-cve-2013-5696.html https://forge.indepnet.net/issues/4480 https://forge.indepnet.net/projects/glpi/repository/revisions/21753/diff/branches/0.84-bugfixes/inc/central.class.php
Created glpi tracking bugs for this issue: Affects: fedora-all [bug 1010831] Affects: epel-all [bug 1010832]
While upstream have improved check in install.php, workarond and better security solution is to drop install.php file once the application is installed. For the available RPM, the /install folder is protected, so is only allowed from local computer thus the vulnerability cannot be exploited. While this vulnerability is considered as critical from upstream version, I think it can be considered as "very low" for RPM.
The real issue is that GLPI 0.84.2 fixed the following security issues [1]: * SQL Injection * PHP Code Execution * CSRF (seems that it is the vector for the SQL injection) In addition, this CVE was noted as being originally assigned to the CSRF flaw, but was re-used for the others. There is a posting on oss-security about a CVE split (need other CVEs for the other issues) [2]. [1] http://www.glpi-project.org/spip.php?page=annonce&id_breve=308 [2] http://www.openwall.com/lists/oss-security/2013/09/20/2
glpi-0.83.9.1-4.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
glpi-0.83.9.1-4.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.
glpi-0.84.2-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.