Detections
Analytics
Debian DSA-898-1 : phpgroupware - programming errors
medium Nessus Plugin ID 22764
Synopsis
The remote Debian host is missing a security-related update.Description
Several vulnerabilities have been discovered in phpsysinfo, a PHP based host information application that is included in phpgroupware.The Common Vulnerabilities and Exposures project identifies the following problems :
- CVE-2005-0870 Maksymilian Arciemowicz discovered several cross site scripting problems, of which not all were fixed in DSA 724.
- CVE-2005-3347 Christopher Kunz discovered that local variables get overwritten unconditionally and are trusted later, which could lead to the inclusion of arbitrary files.
- CVE-2005-3348 Christopher Kunz discovered that user-supplied input is used unsanitised, causing a HTTP Response splitting problem.
Solution
Upgrade the phpgroupware packages.For the old stable distribution (woody) these problems have been fixed in version 0.9.14-0.RC3.2.woody5.
For the stable distribution (sarge) these problems have been fixed in version 0.9.16.005-3.sarge4.
See Also
Plugin Details
Severity: Medium
ID: 22764
File Name: debian_DSA-898.nasl
Version: 1.19
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 10/14/2006
Updated: 1/4/2021
Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:phpgroupware, cpe:/o:debian:debian_linux:3.0, cpe:/o:debian:debian_linux:3.1
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Patch Publication Date: 11/17/2005
Vulnerability Publication Date: 3/23/2005