<<< Date Index >>>     <<< Thread Index >>>

Re: [ GLSA 200501-45 ] Gallery: Cross-site scripting vulnerability



Thanks for the notification.  Lets keep in mind that we don't want to see 
another form of the highlight or sanity issue here, as the removeTags is 
simply the strip_tags PHP function.  As we've seen, not all attacks will 
have HTML tags in them.

gallery fix:

 $username = htmlspecialchars(removeTags(urldecode($username)));

(The same also found in search.php)

phpbb pre-fix:

 $words = explode(' ', 
trim(htmlspecialchars(urldecode($HTTP_GET_VARS['highlight']))));

phpbb fix:

 $words = explode(' ', trim(htmlspecialchars($HTTP_GET_VARS['highlight'])));

I have not taken the time to audit the code, but as we've all become 
familiar with the raw encoded URL during the wonderful days of Christmas, 
it would be a good idea to run a quick test to ensure that base is 
covered.  So hopefully I'm wrong and just being over-paranoid.

In any case, thanks for the update.  Please correct me if I'm off base 
while thinking aloud.

On Sun, 30 Jan 2005, Luke Macken wrote:

> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> Gentoo Linux Security Advisory                           GLSA 200501-45
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
>                                             http://security.gentoo.org/
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> 
>   Severity: Low
>      Title: Gallery: Cross-site scripting vulnerability
>       Date: January 30, 2005
>       Bugs: #78522
>         ID: 200501-45
> 
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> 

-- 
Regards,

Paul Laudanski - Computer Cops, LLC.
CastleCops(SM) - http://castlecops.com
http://justalittlepoke.com | http://cuddlesnkisses.com | 
http://zhen-xjell.com