oss-security - CVE Request: Juju phpmyadmin charm

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140129231617.GA32154@hunt>
Date: Wed, 29 Jan 2014 15:16:17 -0800
From: Seth Arnold <seth.arnold@...onical.com>
To: oss-security@...ts.openwall.com
Cc: security@...ntu.com
Subject: CVE Request: Juju phpmyadmin charm

Hello Kurt, vendors, MITRE,

Please assign a CVE for the following issue:

I discovered a potentially unsafe use of PHP's preg_replace() /e option in
the Juju charm phpmyadmin:

$xml = simplexml_load_string(preg_replace("/(<\/?)media\:content([^>]*>)/e",
    '', str_replace('media:hash',
        'hash',
	file_get_contents('https://sourceforge.net/api/file/index/project-id/23067/mtime/desc/limit/40/rss'))));

An attacker able to spoof ARP, DNS, or BGP, or control any of the routers
between the client and sourceforge.net, or control over the sourceforge
project or sourceforge servers, would be in a position to insert likely
aribtrary code into the PHP interpreter.

The full source of this file can be found at:

http://bazaar.launchpad.net/~charmers/charms/precise/phpmyadmin/trunk/view/head:/bin/parse_upstream

I have reported the bug to:

https://bugs.launchpad.net/charms/+source/phpmyadmin/+bug/1274264

The problem appears to have been introduced in revision 18. No fix is
currently available.

Thanks

Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.