Smarty Template Engine 'Smarty_Compiler.class.php' Security Bypass Vulnerability

Bugtraq ID:	31862
Class:	Access Validation Error
CVE:	CVE-2008-4810 CVE-2008-4811
Remote:	Yes
Local:	No
Published:	Oct 20 2008 12:00AM
Updated:	Apr 13 2015 10:08PM
Credit:	trueend5
Vulnerable:	Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Smarty Template Engine 2.6.19 Pardus Linux 2008 0 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 Mahara Mahara 1.1.7 Mahara Mahara 1.1.6 Mahara Mahara 1.1.5 Mahara Mahara 1.1.4 Mahara Mahara 1.1.3 Mahara Mahara 1.1.2 Mahara Mahara 1.1.1 Mahara Mahara 1.0.13 Mahara Mahara 1.0.12 Mahara Mahara 1.0.11 Mahara Mahara 1.0.10 Mahara Mahara 1.0.9 Mahara Mahara 1.0.8 Mahara Mahara 1.0.6 Mahara Mahara 1.0.5 Mahara Mahara 1.0.4 Mahara Mahara 1.0.3 Mahara Mahara 1.0.2 Mahara Mahara 1.0.1 Mahara Mahara 1.0 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	Smarty Template Engine 2.6.20-1 Mahara Mahara 1.1.8 Mahara Mahara 1.0.14

Smarty Template Engine 'Smarty_Compiler.class.php' Security Bypass Vulnerability

Smarty Template Engine is prone to a security-bypass vulnerability that occurs when embedded variables are processed.

Attackers may exploit the issue to bypass certain security restrictions and execute arbitrary PHP code in the context of the application.

Smarty Template Engine 2.6.19 is vulnerable to the issue; other versions may also be affected.

Smarty Template Engine 'Smarty_Compiler.class.php' Security Bypass Vulnerability

Attackers can exploit this issue via a browser.

Smarty Template Engine 'Smarty_Compiler.class.php' Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.


Debian Linux 5.0 ia-64

• Debian smarty_2.6.20-1.2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 2_all.deb


• Debian smarty_2.6.20-1.3_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 3_all.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu moodle_1.8.2-1ubuntu4.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1ubu ntu4.2_all.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu moodle_1.8.2-1.2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1.2u buntu2.1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu moodle_1.8.2-1ubuntu4.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1ubu ntu4.2_all.deb

Debian Linux 5.0 alpha

• Debian smarty_2.6.20-1.2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 2_all.deb


• Debian smarty_2.6.20-1.3_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 3_all.deb

Mandriva Linux Mandrake 2008.0 x86_64

• Mandriva php-smarty-2.6.22-0.1mdv2008.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva php-smarty-manual-2.6.22-0.1mdv2008.0.noarch.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu moodle_1.8.2-1ubuntu4.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1ubu ntu4.2_all.deb

Mandriva Linux Mandrake 2008.0

• Mandriva php-smarty-2.6.22-0.1mdv2008.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva php-smarty-manual-2.6.22-0.1mdv2008.0.noarch.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 mipsel

• Debian smarty_2.6.20-1.2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 2_all.deb


• Debian smarty_2.6.20-1.3_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 3_all.deb

Debian Linux 4.0 amd64

• Debian moodle_1.6.3-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+e tch1_all.deb


• Debian smarty_2.6.14-1etch2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.14-1e tch2_all.deb

Debian Linux 4.0 ia-32

• Debian moodle_1.6.3-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+e tch1_all.deb


• Debian smarty_2.6.14-1etch2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.14-1e tch2_all.deb

Debian Linux 4.0 hppa

• Debian moodle_1.6.3-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+e tch1_all.deb


• Debian smarty_2.6.14-1etch2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.14-1e tch2_all.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu moodle_1.8.2-1.2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1.2u buntu2.1_all.deb

Debian Linux 4.0 armel

• Debian smarty_2.6.14-1etch2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.14-1e tch2_all.deb

Debian Linux 5.0 armel

• Debian smarty_2.6.20-1.2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 2_all.deb


• Debian smarty_2.6.20-1.3_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 3_all.deb

Debian Linux 5.0

• Debian smarty_2.6.20-1.2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 2_all.deb


• Debian smarty_2.6.20-1.3_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 3_all.deb

Debian Linux 4.0 mipsel

• Debian moodle_1.6.3-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+e tch1_all.deb


• Debian smarty_2.6.14-1etch2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.14-1e tch2_all.deb

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva php-smarty-2.6.22-0.1mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva php-smarty-manual-2.6.22-0.1mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 mips

• Debian smarty_2.6.20-1.2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 2_all.deb


• Debian smarty_2.6.20-1.3_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 3_all.deb

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu moodle_1.8.2-1.2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1.2u buntu2.1_all.deb

Debian Linux 4.0 ia-64

• Debian moodle_1.6.3-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+e tch1_all.deb


• Debian smarty_2.6.14-1etch2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.14-1e tch2_all.deb

Debian Linux 4.0 mips

• Debian moodle_1.6.3-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+e tch1_all.deb


• Debian smarty_2.6.14-1etch2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.14-1e tch2_all.deb

Debian Linux 5.0 sparc

• Debian smarty_2.6.20-1.2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 2_all.deb


• Debian smarty_2.6.20-1.3_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 3_all.deb

Mandriva Linux Mandrake 2008.1 x86_64

• Mandriva php-smarty-2.6.22-0.1mdv2008.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva php-smarty-manual-2.6.22-0.1mdv2008.1.noarch.rpm
  http://www.mandriva.com/en/download/

Debian Linux 4.0 arm

• Debian moodle_1.6.3-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+e tch1_all.deb


• Debian smarty_2.6.14-1etch2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.14-1e tch2_all.deb

Mandriva Linux Mandrake 2008.1

• Mandriva php-smarty-2.6.22-0.1mdv2008.1.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva php-smarty-manual-2.6.22-0.1mdv2008.1.noarch.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu moodle_1.8.2-1.2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1.2u buntu2.1_all.deb

Debian Linux 4.0 powerpc

• Debian moodle_1.6.3-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+e tch1_all.deb


• Debian smarty_2.6.14-1etch2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.14-1e tch2_all.deb

Debian Linux 4.0 m68k

• Debian moodle_1.6.3-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+e tch1_all.deb


• Debian smarty_2.6.14-1etch2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.14-1e tch2_all.deb

Debian Linux 5.0 ia-32

• Debian smarty_2.6.20-1.2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 2_all.deb


• Debian smarty_2.6.20-1.3_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 3_all.deb

Debian Linux 5.0 s/390

• Debian smarty_2.6.20-1.2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 2_all.deb


• Debian smarty_2.6.20-1.3_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 3_all.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu moodle_1.8.2-1ubuntu4.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1ubu ntu4.2_all.deb

Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu moodle_1.8.2-1.2ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1.2u buntu2.1_all.deb

Debian Linux 5.0 hppa

• Debian smarty_2.6.20-1.2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 2_all.deb


• Debian smarty_2.6.20-1.3_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 3_all.deb

Debian Linux 4.0 sparc

• Debian moodle_1.6.3-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+e tch1_all.deb


• Debian smarty_2.6.14-1etch2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.14-1e tch2_all.deb

Debian Linux 4.0 s/390

• Debian moodle_1.6.3-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+e tch1_all.deb


• Debian smarty_2.6.14-1etch2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.14-1e tch2_all.deb

Debian Linux 5.0 m68k

• Debian smarty_2.6.20-1.2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 2_all.deb


• Debian smarty_2.6.20-1.3_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 3_all.deb

Mandriva Linux Mandrake 2009.0

• Mandriva php-smarty-2.6.22-0.1mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva php-smarty-manual-2.6.22-0.1mdv2009.0.noarch.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 arm

• Debian smarty_2.6.20-1.2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 2_all.deb


• Debian smarty_2.6.20-1.3_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 3_all.deb

Debian Linux 4.0 alpha

• Debian moodle_1.6.3-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+e tch1_all.deb


• Debian smarty_2.6.14-1etch2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.14-1e tch2_all.deb

MandrakeSoft Corporate Server 4.0

• Mandriva php-smarty-2.6.22-0.1.20060mlcs4.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva php-smarty-manual-2.6.22-0.1.20060mlcs4.noarch.rpm
  http://www.mandriva.com/en/download/

Debian Linux 4.0

• Debian moodle_1.6.3-2+etch1_all.deb
  http://security.debian.org/pool/updates/main/m/moodle/moodle_1.6.3-2+e tch1_all.deb


• Debian smarty_2.6.14-1etch2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.14-1e tch2_all.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu moodle_1.8.2-1ubuntu4.2_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/m/moodle/moodle_1.8.2-1ubu ntu4.2_all.deb

Debian Linux 5.0 amd64

• Debian smarty_2.6.20-1.2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 2_all.deb


• Debian smarty_2.6.20-1.3_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 3_all.deb

Debian Linux 5.0 powerpc

• Debian smarty_2.6.20-1.2_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 2_all.deb


• Debian smarty_2.6.20-1.3_all.deb
  http://security.debian.org/pool/updates/main/s/smarty/smarty_2.6.20-1. 3_all.deb

MandrakeSoft Corporate Server 4.0 x86_64

• Mandriva php-smarty-2.6.22-0.1.20060mlcs4.noarch.rpm
  http://www.mandriva.com/en/download/


• Mandriva php-smarty-manual-2.6.22-0.1.20060mlcs4.noarch.rpm
  http://www.mandriva.com/en/download/

Smarty Template Engine 'Smarty_Compiler.class.php' Security Bypass Vulnerability

References:

• Arbitrary code execution in 1.0.13 and 1.1.7 (Mahara)
  
• Bug #467317 - Security Update for php-smarty (Red Hat)
  
• Mahara 1.2.4, 1.1.8, and 1.0.14 Released (Mahara)
  
• Smarty Homepage (Smarty)