Your message dated Sun, 23 Jan 2005 07:47:07 -0500
with message-id <[EMAIL PROTECTED]>
and subject line Bug#291718: fixed in gforge 3.1-26
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 22 Jan 2005 17:52:30 +0000
>From [EMAIL PROTECTED] Sat Jan 22 09:52:29 2005
Return-path: <[EMAIL PROTECTED]>
Received: from c201166.ppp.asahi-net.or.jp (grapefruit) [210.155.201.166]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1CsPQz-0008WT-00; Sat, 22 Jan 2005 09:52:29 -0800
Received: by grapefruit (Postfix, from userid 1000)
id D6A80402F; Sun, 23 Jan 2005 02:56:08 +0900 (JST)
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Hideki Yamane <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: gforge: [security] GForge 3.x directory traversal vulnerability
X-Mailer: reportbug 3.6
Date: Sun, 23 Jan 2005 02:56:07 +0900
Message-Id: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
Package: gforge
Severity: grave
Tags: security
Justification: user security hole
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Dear gforge maintainer,
GForge 3.x has directory traversal vulnerabilities because of lack
about sanitisation in some scripts.
You can see detail about vulnerability with PoC and workaround
in this advisory
http://www.securityfocus.com/archive/1/387850/2005-01-19/2005-01-25/0
- --
Regards,
Hideki Yamane henrich @ samba.gr.jp/iijmio-mail.jp
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
iD8DBQFB8pO2Iu0hy8THJksRAhE8AJ4gntmdUoj0zApRAK6YfGvhsx7UtgCfXutm
xg2AiEbs1UB7saoWJlNdBgA=
=yAVX
-----END PGP SIGNATURE-----
---------------------------------------
Received: (at 291718-close) by bugs.debian.org; 23 Jan 2005 12:53:05 +0000
>From [EMAIL PROTECTED] Sun Jan 23 04:53:05 2005
Return-path: <[EMAIL PROTECTED]>
Received: from newraff.debian.org [208.185.25.31] (mail)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1CshEn-0006a6-00; Sun, 23 Jan 2005 04:53:05 -0800
Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian))
id 1Csh91-0004Xw-00; Sun, 23 Jan 2005 07:47:07 -0500
From: Roland Mas <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.55 $
Subject: Bug#291718: fixed in gforge 3.1-26
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Sun, 23 Jan 2005 07:47:07 -0500
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
Source: gforge
Source-Version: 3.1-26
We believe that the bug you reported is fixed in the latest version of
gforge, which is due to be installed in the Debian FTP archive:
gforge-common_3.1-26_all.deb
to pool/main/g/gforge/gforge-common_3.1-26_all.deb
gforge-cvs_3.1-26_all.deb
to pool/main/g/gforge/gforge-cvs_3.1-26_all.deb
gforge-db-postgresql_3.1-26_all.deb
to pool/main/g/gforge/gforge-db-postgresql_3.1-26_all.deb
gforge-dns-bind9_3.1-26_all.deb
to pool/main/g/gforge/gforge-dns-bind9_3.1-26_all.deb
gforge-ftp-proftpd_3.1-26_all.deb
to pool/main/g/gforge/gforge-ftp-proftpd_3.1-26_all.deb
gforge-ldap-openldap_3.1-26_all.deb
to pool/main/g/gforge/gforge-ldap-openldap_3.1-26_all.deb
gforge-lists-mailman_3.1-26_all.deb
to pool/main/g/gforge/gforge-lists-mailman_3.1-26_all.deb
gforge-mta-exim4_3.1-26_all.deb
to pool/main/g/gforge/gforge-mta-exim4_3.1-26_all.deb
gforge-mta-exim_3.1-26_all.deb
to pool/main/g/gforge/gforge-mta-exim_3.1-26_all.deb
gforge-mta-postfix_3.1-26_all.deb
to pool/main/g/gforge/gforge-mta-postfix_3.1-26_all.deb
gforge-shell-ldap_3.1-26_all.deb
to pool/main/g/gforge/gforge-shell-ldap_3.1-26_all.deb
gforge-sourceforge-transition_3.1-26_all.deb
to pool/main/g/gforge/gforge-sourceforge-transition_3.1-26_all.deb
gforge-web-apache_3.1-26_all.deb
to pool/main/g/gforge/gforge-web-apache_3.1-26_all.deb
gforge_3.1-26.diff.gz
to pool/main/g/gforge/gforge_3.1-26.diff.gz
gforge_3.1-26.dsc
to pool/main/g/gforge/gforge_3.1-26.dsc
gforge_3.1-26_all.deb
to pool/main/g/gforge/gforge_3.1-26_all.deb
sourceforge_3.1-26_all.deb
to pool/main/g/gforge/sourceforge_3.1-26_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Roland Mas <[EMAIL PROTECTED]> (supplier of updated gforge package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Sun, 23 Jan 2005 12:59:25 +0100
Source: gforge
Binary: gforge-lists-mailman gforge-db-postgresql sourceforge
gforge-mta-postfix gforge-sourceforge-transition gforge-shell-ldap gforge
gforge-common gforge-web-apache gforge-mta-exim gforge-cvs gforge-ftp-proftpd
gforge-mta-exim4 gforge-dns-bind9 gforge-ldap-openldap
Architecture: source all
Version: 3.1-26
Distribution: unstable
Urgency: high
Maintainer: Roland Mas <[EMAIL PROTECTED]>
Changed-By: Roland Mas <[EMAIL PROTECTED]>
Description:
gforge - Collaborative development tool - meta-package
gforge-common - Collaborative development tool - shared files
gforge-cvs - Collaborative development tool - CVS management
gforge-db-postgresql - Collaborative development tool - database (using
PostgreSQL)
gforge-dns-bind9 - Collaborative development tool - DNS management (using
Bind9)
gforge-ftp-proftpd - Collaborative development tool - FTP management (using
ProFTPd)
gforge-ldap-openldap - Collaborative development tool - LDAP directory (using
OpenLDAP)
gforge-lists-mailman - Collaborative development tool - mailing-lists (using
Mailman)
gforge-mta-exim - Collaborative development tool - mail tools (using Exim)
gforge-mta-exim4 - Collaborative development tool - mail tools (using Exim 4)
gforge-mta-postfix - Collaborative development tool - mail tools (using
Postfix)
gforge-shell-ldap - Collaborative development tool - shell accounts (using
LDAP)
gforge-sourceforge-transition - Sourceforge to Gforge data transition
gforge-web-apache - Collaborative development tool - web part (using Apache)
sourceforge - Empty package to help with Sourceforge to Gforge transition
Closes: 291718
Changes:
gforge (3.1-26) unstable; urgency=high
.
* Disabled controller.php and controlleroo.php because of security
risks, hence the high urgency upload (closes: #291718).
Files:
1535df31eee8a65751d321ad8a09aee1 856 devel optional gforge_3.1-26.dsc
31d85115b54a1e8053354493c8f2c8b1 284641 devel optional gforge_3.1-26.diff.gz
dfe0aa29375780f96b58d842ff1bc24e 55722 devel optional gforge_3.1-26_all.deb
7d0d244bd0b82edea97a093a99c2855a 92202 devel optional
gforge-common_3.1-26_all.deb
43009e7bc69196593eed28c7d2acec71 1103562 devel optional
gforge-web-apache_3.1-26_all.deb
e288534bb3d211208c91a920f35cbe8e 145694 devel optional
gforge-db-postgresql_3.1-26_all.deb
f0da279fef1254b165dc0af84ffdb175 64358 devel optional
gforge-mta-exim4_3.1-26_all.deb
cb839e7ff7ca4d90a1d30f03879d0842 63894 devel optional
gforge-mta-exim_3.1-26_all.deb
3139cbc57e574265740a843f83848770 63986 devel optional
gforge-mta-postfix_3.1-26_all.deb
3cb9d96c6a17bb75cda72f56cb542d92 60326 devel optional
gforge-shell-ldap_3.1-26_all.deb
6e5c1c2ecf5af1b058ef51f50c96893b 97302 devel optional gforge-cvs_3.1-26_all.deb
a2e7e061cee687e5e9656660296c4133 59190 devel optional
gforge-ftp-proftpd_3.1-26_all.deb
1b9d3de911d87ec5da6c9c938445983a 69776 devel optional
gforge-ldap-openldap_3.1-26_all.deb
41c125e4c299f98e89c9cd332309ad07 71594 devel optional
gforge-dns-bind9_3.1-26_all.deb
d4c3917e4bd0d573b6af52ff3064235b 57428 devel optional
gforge-lists-mailman_3.1-26_all.deb
387dc1e9b95acd902283c9c675325b3b 58332 devel optional
gforge-sourceforge-transition_3.1-26_all.deb
969426f639003237acc7efb42a297317 55044 devel extra sourceforge_3.1-26_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
iD8DBQFB85l5DqdWtRRIQ/URAswNAJ0e9s+uNFV6BLj6IUfyN6mo3yI8mgCgpZw6
aUlCXGOXOqmQpYJVpDNQNN0=
=WgFy
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
