Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title phpldapadmin security update
Informations
Name DSA-2333 First vendor Publication 2011-10-31
Vendor Debian Last vendor Modification 2011-10-31
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Two vulnerabilities have been discovered in phpldapadmin, a web based interface for administering LDAP servers. The Common Vulnerabilities and Exposures project identifies the following problems:

CVE-2011-4074

Input appended to the URL in cmd.php (when "cmd" is set to "_debug") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

CVE-2011-4075

Input passed to the "orderby" parameter in cmd.php (when "cmd" is set to "query_engine", "query" is set to "none", and "search" is set to e.g. "1") is not properly sanitised in lib/functions.php before being used in a "create_function()" function call. This can be exploited to inject and execute arbitrary PHP code.

For the oldstable distribution (lenny), these problems have been fixed in version 1.1.0.5-6+lenny2.

For the stable distribution (squeeze), these problems have been fixed in version 1.2.0.5-2+squeeze1.

For the testing distribution (wheezy), these problems will be fixed soon.

For the unstable distribution (sid), these problems have been fixed in version 1.2.0.5-2.1.

We recommend that you upgrade your phpldapadmin packages.

Original Source

Url : http://www.debian.org/security/2011/dsa-2333

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-94 Failure to Control Generation of Code ('Code Injection')
50 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:14902
 
Oval ID: oval:org.mitre.oval:def:14902
Title: DSA-2333-1 phpldapadmin -- several
Description: Two vulnerabilities have been discovered in phpldapadmin, a web based interface for administering LDAP servers. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2011-4074 Input appended to the URL in cmd.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. CVE-2011-4075 Input passed to the "orderby" parameter in cmd.php is not properly sanitised in lib/functions.php before being used in a "create_function" function call. This can be exploited to inject and execute arbitrary PHP code.
Family: unix Class: patch
Reference(s): DSA-2333-1
CVE-2011-4075
CVE-2011-4074
 Version: 5
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
 Product(s): phpldapadmin
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 8

OpenVAS Exploits

Date Description
2012-04-02 Name : Fedora Update for phpldapadmin FEDORA-2011-14924
File : nvt/gb_fedora_2011_14924_phpldapadmin_fc16.nasl
2012-02-11 Name : Debian Security Advisory DSA 2333-1 (phpldapadmin)
File : nvt/deb_2333_1.nasl
2011-11-25 Name : Fedora Update for phpldapadmin FEDORA-2011-14986
File : nvt/gb_fedora_2011_14986_phpldapadmin_fc14.nasl
2011-11-25 Name : Fedora Update for phpldapadmin FEDORA-2011-14993
File : nvt/gb_fedora_2011_14993_phpldapadmin_fc15.nasl
2011-11-03 Name : Mandriva Update for phpldapadmin MDVSA-2011:163 (phpldapadmin)
File : nvt/gb_mandriva_MDVSA_2011_163.nasl
2011-11-03 Name : phpLDAPadmin '_debug' Cross Site Scripting Vulnerability
File : nvt/gb_phpldapadmin_debug_xss_vuln.nasl
2011-10-25 Name : phpLDAPadmin 'functions.php' Remote PHP Code Injection Vulnerability
File : nvt/gb_phpldapadmin_50331.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
76594 phpLDAPadmin cmd.php orderby Parameter Arbitrary PHP Code Execution

phpLDAPadmin contains a flaw related to the lib/functions.php script failing to properly sanitize input passed to the cmd.php script via the 'orderby' parameter before use in a 'create_function()' function call. This may allow a remote attacker to execute arbitrary PHP code.
76593 phpLDAPadmin cmd.php URI XSS

phpLDAPadmin contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate input passed via the URL upon submission to the cmd.php script. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

Nessus® Vulnerability Scanner

Date Description
2011-11-26 Name : The remote Fedora host is missing a security update.
File : fedora_2011-14924.nasl - Type : ACT_GATHER_INFO
2011-11-26 Name : The remote Fedora host is missing a security update.
File : fedora_2011-14986.nasl - Type : ACT_GATHER_INFO
2011-11-26 Name : The remote Fedora host is missing a security update.
File : fedora_2011-14993.nasl - Type : ACT_GATHER_INFO
2011-11-03 Name : The remote web server hosts a PHP application that can be abused to execute a...
File : phpldapadmin_orderby_cmd_exec.nasl - Type : ACT_ATTACK
2011-10-31 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2333.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:30:32
  • Multiple Updates