MantisBT <1.2.7 search.php multiple XSS vulnerabilities

[David Hicks]

Original vulnerability report by Net.Edit0r (<email address hidden>) from BlACK Hat Group [http://black-hg.org] is available at: http://packetstormsecurity.org/files/104149

MantisBT bug report for full details of the issue: http://www.mantisbt.org/bugs/view.php?id=13245

Please note that the second SQL injection vulnerability identified by Net.Edit0r is not reproducible (refer to the MantisBT bug report above for reasons why).

A patch for 1.2.6 is available at:
https://github.com/mantisbt/mantisbt/commit/317f3db3a3c68775de3acf3b15f55b1e3c18f93b

MantisBT 1.2.7 is currently being packaged and will be available shortly through usual channels.

A CVE request and notice has been sent to <email address hidden>

[David Hicks (dhx)]

Original vulnerability report by Net.Edit0r (<email address hidden>) from BlACK Hat Group [http://black-hg.org] is available at:
http://packetstormsecurity.org/files/104149

MantisBT bug report for full details of the issue: http://www.mantisbt.org/bugs/view.php?id=13245

Please note that the second SQL injection vulnerability identified by Net.Edit0r is not reproducible (refer to the MantisBT bug report above for reasons why).

A patch for 1.2.6 is available at:
https://github.com/mantisbt/mantisbt/commit/317f3db3a3c68775de3acf3b15f55b1e3c18f93b

MantisBT 1.2.7 is currently being packaged and will be available shortly through usual channels for distributions and standalone users to pick up.

Reproducible: Always

[David (david-redhat-bugs)]

Original vulnerability report by Net.Edit0r (<email address hidden>) from BlACK Hat
Group [http://black-hg.org] is available at:
http://packetstormsecurity.org/files/104149

MantisBT bug report for full details of the issue:
http://www.mantisbt.org/bugs/view.php?id=13245

Please note that the second SQL injection vulnerability identified by
Net.Edit0r is not reproducible (refer to the MantisBT bug report above for
reasons why).

A patch for 1.2.6 is available at:
https://github.com/mantisbt/mantisbt/commit/317f3db3a3c68775de3acf3b15f55b1e3c18f93b

MantisBT 1.2.7 is currently being packaged and will be available shortly
through usual channels.

A CVE request and notice has been sent to <email address hidden>

[Ago-3 (ago-3)]

1.2.7 Is not still out, but the vulnerability is fixed in git repository.

@Peter, Please choise if you want add directly 1.2.7, or patch 1.2.6.

[Vincent (vincent-redhat-bugs)]

Thanks so much for the report, David!

[Vincent (vincent-redhat-bugs)]

Created mantis tracking bugs for this issue

Affects: fedora-all [bug 731854]
Affects: epel-5 [bug 731855]

[Vincent (vincent-redhat-bugs)]

This was assigned the name CVE-2011-2938.

[pva (pva)]

1.2.7 that fixes this issue is in the tree. Arch teams, please, stabilize.

[Ago-3 (ago-3)]

amd64 ok

[Xarthisius (xarthisius)]

ppc keywords dropped

[Jamie Strandboge (jdstrand)]

Per Debian, 1.1 is not affected. Oneiric is affected.

Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest posting a debdiff for this issue. When a debdiff is available, a member of Ubuntu will review it and publish the package.

Thanks!

[Tomka-w (tomka-w)]

x86 stable. Thanks

[Chainsaw (chainsaw)]

+ 26 Aug 2011; Tony Vroon <email address hidden> mantisbt-1.2.7.ebuild:
+ Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo in
+ security bug #379739 filed by David Hicks.

Arches done, ready for GLSA voting.

[Alex Legler (a3li)]

Closing noglsa.

[Jamie Strandboge (jdstrand)]

[Updating] mantis (1.2.4-3 [Ubuntu] < 1.2.6-1 [Debian])
 * Trying to add mantis...
2011-08-26 19:29:18 INFO - <mantis_1.2.6-1.dsc: downloading from http://ftp.debian.org/debian/>
2011-08-26 19:29:18 INFO - <mantis_1.2.6-1.debian.tar.gz: downloading from http://ftp.debian.org/debian/>
2011-08-26 19:29:18 INFO - <mantis_1.2.6.orig.tar.gz: downloading from http://ftp.debian.org/debian/>
I: mantis [universe] -> mantis_1.2.4-3 [universe].

[Vincent (vincent-redhat-bugs)]

Currently supported versions of Fedora have 1.2.8, which correct this flaw. EPEL's 1.1.8 may still be affected.

[Vincent (vincent-redhat-bugs)]

EPEL5 hasn't been touched since Dec 2010, and the package is technically orphaned. As a result I'm closing this bug as this issue is fixed in Fedora. The EPEL5 tracking bug #800667 will remain open until either mantis is dropped from EPEL or it is fixed.