bugtraq - Re: Multiple Injection Vulnerabilities in PHP PEAR::Auth Module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.61.0602221316090.8543@lariatasp>
Date: Wed, 22 Feb 2006 13:32:21 -0700 (MST)
From: "Benjamin R. Ginter" <bginter@...vtech.net>
To: Matt Van Gundy <matt@...kinahstudios.com>
Cc: bugtraq@...urityfocus.com
Subject: Re: Multiple Injection Vulnerabilities in PHP PEAR::Auth Module

Thanks for the advisory.

Just out of curiosity, is there a reason why you did not specify which 
backends are vulnerable?

Yeah, I can go dig it up (and will) but the advisory would have been far 
more useful if it included the list of vulnerable backends; end users 
could know at a glance if they _need_ to upgrade.

Thanks again,

Ben

On Tue, 21 Feb 2006, Matt Van Gundy wrote:

> PRODUCT:
>    PEAR::Auth Authentication Module Package
>    http://pear.php.net/package/Auth
>
> VERSIONS AFFECTED:
>    All versions < 1.2.4
>    1.3 series < 1.3.0r4
>
> DESCRIPTION:
>    Some of the PEAR::Auth Container back ends do not fully validate
> ...