FreeBSD : gallery2 -- multiple vulnerabilities (4aab7bcd-b294-11dc-a6f0-00a0cce0781e)

critical Nessus Plugin ID 29796

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

The Gallery team reports :

Gallery 2.2.4 addresses the following security vulnerabilities :

- Publish XP module - Fixed unauthorized album creation and file uploads.

- URL rewrite module - Fixed local file inclusion vulnerability in unsecured admin controller and information disclosure in hotlink protection.

- Core / add-item modules - Fixed Cross Site Scripting (XSS) vulnerabilities through malicious file names.

- Installation (Gallery application) - Update web-accessibility protection of the storage folder for Apache 2.2.

- Core (Gallery application) / MIME module - Fixed vulnerability in checks for disallowed file extensions in file uploads.

- Gallery Remote module - Added missing permissions checks for some GR commands.

- WebDAV module - Fixed Cross Site Scripting (XSS) vulnerability through HTTP PROPPATCH.

- WebDAV module - Fixed information (item data) disclosure in a WebDAV view.

- Comment module - Fixed information (item data) disclosure in comment views.

- Core module (Gallery application) - Improved resilience against item information disclosure attacks.

- Slideshow module - Fixed information (item data) disclosure in the slideshow.

- Print modules - Fixed information (item data) disclosure in several print modules.

- Core / print modules - Fixed arbitrary URL redirection (phishing attacks) in the core module and several print modules.

- WebCam module - Fixed proxied request weakness.

Solution

Update the affected package.

See Also

http://galleryproject.org/gallery_2.2.4_released

http://www.nessus.org/u?755d6dac

Plugin Details

Severity: Critical

ID: 29796

File Name: freebsd_pkg_4aab7bcdb29411dca6f000a0cce0781e.nasl

Version: 1.17

Type: local

Published: 12/26/2007

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:gallery2, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 12/25/2007

Vulnerability Publication Date: 12/24/2007

Reference Information

CVE: CVE-2007-6685, CVE-2007-6686, CVE-2007-6687, CVE-2007-6689, CVE-2007-6690, CVE-2007-6692

CWE: 20, 264, 59, 79