Smarty Template Engine '{fetch}' Tag Security Bypass Vulnerability

Bugtraq ID:	48188
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jun 09 2011 12:00AM
Updated:	Jun 09 2011 12:00AM
Credit:	willwoodlief
Vulnerable:	Smarty Template Engine 2.6.23 Smarty Template Engine 2.6.22 Smarty Template Engine 2.6.19 Smarty Template Engine 2.6.18 Smarty Template Engine 2.6.17 Smarty Template Engine 2.6.16 Smarty Template Engine 2.6.15 Smarty Template Engine 2.6.14 Smarty Template Engine 2.6.13 Smarty Template Engine 2.6.12 Smarty Template Engine 2.6.11 Smarty Template Engine 2.6.10 Smarty Template Engine 2.6.9 Smarty Template Engine 2.6.8 Smarty Template Engine 2.6.7 + Gentoo Linux Smarty Template Engine 2.6.6 Smarty Template Engine 2.6.5 Smarty Template Engine 2.6.4 Smarty Template Engine 2.6.3 Smarty Template Engine 2.6.2 Smarty Template Engine 2.6.1 Smarty Template Engine 2.6 Smarty Template Engine 3.0.8 Smarty Template Engine 3.0.7 Smarty Template Engine 3.0.6 Smarty Template Engine 2.6.20-1
Not Vulnerable:

Smarty Template Engine '{fetch}' Tag Security Bypass Vulnerability

Smarty Template Engine is prone to a security-bypass vulnerability because the '{fetch}' tag fails to recognize certain security settings.

Attackers may exploit the issue to bypass certain security restrictions to obtain files outside of the defined '$secure_dir' path.

Smarty Template Engine 3.0.8 is vulnerable; other versions may also be affected.

Smarty Template Engine '{fetch}' Tag Security Bypass Vulnerability

Attackers can exploit this issue via a browser.

Smarty Template Engine '{fetch}' Tag Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Smarty Template Engine '{fetch}' Tag Security Bypass Vulnerability

References:

• Revision: r4119 (smarty-php)
  
• Smarty Homepage (Smarty)
  
• trying to understand security for {fetch} tag (willwoodlief)