PHProjekt Directory Escaping Vulnerability

Bugtraq ID:	2702
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 08 2001 12:00AM
Updated:	May 08 2001 12:00AM
Credit:	This vulnerability was originally discovered by Daniel Wittenberg, and announced to Bugtraq by Albrecht Guenther <[email protected]> on May 8, 2001.
Vulnerable:	PHProjekt PHProjekt 2.1 - Debian Linux 2.2 - FreeBSD FreeBSD 4.2 - FreeBSD FreeBSD 3.5.1 - HP HP-UX 11.11 - HP HP-UX 11.0 - HP HP-UX 10.20 - Mandriva Linux Mandrake 8.0 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 - OpenBSD OpenBSD 2.9 - OpenBSD OpenBSD 2.8 - OpenBSD OpenBSD 2.7 - Redhat Linux 7.1 - Redhat Linux 7.0 - Redhat Linux 6.2 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 - SuSE Linux 7.1 - SuSE Linux 7.0 PHProjekt PHProjekt 2.0.1 - Debian Linux 2.2 - FreeBSD FreeBSD 4.2 - FreeBSD FreeBSD 3.5.1 - HP HP-UX 11.11 - HP HP-UX 11.0 - HP HP-UX 10.20 - Mandriva Linux Mandrake 8.0 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 - OpenBSD OpenBSD 2.9 - OpenBSD OpenBSD 2.8 - OpenBSD OpenBSD 2.7 - Redhat Linux 7.1 - Redhat Linux 7.0 - Redhat Linux 6.2 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 - SuSE Linux 7.1 - SuSE Linux 7.0 PHProjekt PHProjekt 2.0 - Debian Linux 2.2 - FreeBSD FreeBSD 4.2 - FreeBSD FreeBSD 3.5.1 - HP HP-UX 11.11 - HP HP-UX 11.0 - HP HP-UX 10.20 - Mandriva Linux Mandrake 8.0 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 - OpenBSD OpenBSD 2.9 - OpenBSD OpenBSD 2.8 - OpenBSD OpenBSD 2.7 - Redhat Linux 7.1 - Redhat Linux 7.0 - Redhat Linux 6.2 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 - SuSE Linux 7.1 - SuSE Linux 7.0
Not Vulnerable:	PHProjekt PHProjekt 2.1 a - Debian Linux 2.2 - FreeBSD FreeBSD 4.2 - FreeBSD FreeBSD 3.5.1 - HP HP-UX 11.11 - HP HP-UX 11.0 - HP HP-UX 10.20 - Mandriva Linux Mandrake 8.0 - Mandriva Linux Mandrake 7.2 - Mandriva Linux Mandrake 7.1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 - OpenBSD OpenBSD 2.9 - OpenBSD OpenBSD 2.8 - OpenBSD OpenBSD 2.7 - Redhat Linux 7.1 - Redhat Linux 7.0 - Redhat Linux 6.2 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 - SuSE Linux 7.1 - SuSE Linux 7.0

PHProjekt Directory Escaping Vulnerability

PHProjekt is a freely available, open source PHP Groupware package. It is actively maintained by the PHProjekt Development Team.

A problem in the package could allow users of the software access to unauthorized resources. Due to insufficient checking of input, it is possible for a user to append a request with the dot-dot (..) extension, breaking out of the confines of the configuration limitations.

This makes it possible for remote user to gain access to restricted resources, and gather information or potentially gain local access.

PHProjekt Directory Escaping Vulnerability

See discussion.

PHProjekt Directory Escaping Vulnerability

Solution:
Patch available:


PHProjekt PHProjekt 2.0

• PHPProjekt PHPProjekt Patch 2.1
  http://www.phprojekt.com/download/patch-2.1.tar.gz

PHProjekt PHProjekt 2.0.1

• PHPProjekt PHPProjekt Patch 2.1
  http://www.phprojekt.com/download/patch-2.1.tar.gz

PHProjekt PHProjekt 2.1

• PHPProjekt PHPProjekt Patch 2.1
  http://www.phprojekt.com/download/patch-2.1.tar.gz

PHProjekt Directory Escaping Vulnerability

References: