| Beschreibung: | Description:
The remote host is missing an update to egroupware
announced via advisory MDKSA-2005:212.
Egroupware contains embedded copies of several php based projects,
including phpldapadmin and phpsysinfo.
Phpldapadmin before 0.9.6c allows remote attackers to gain anonymous
access to the LDAP server, even when disable_anon_bind is set, via an
HTTP request to login.php with the anonymous_bind parameter set.
(CVE-2005-2654)
Directory traversal vulnerability in welcome.php in phpLDAPadmin 0.9.6
and 0.9.7 allows remote attackers to read arbitrary files via a ..
(dot dot) in the custom_welcome_page parameter. (CVE-2005-2792)
PHP remote code injection vulnerability in welcome.php in phpLDAPadmin
0.9.6 and 0.9.7 allows remote attackers to execute arbitrary PHP code
via the custom_welcome_page parameter. (CVE-2005-2793)
Maksymilian Arciemowicz discovered several cross site scripting issues
in phpsysinfo, a PHP based host information application.
(CVE-2005-0869, 0870)
Christopher Kunz discovered that local variables in phpsysinfo get
overwritten unconditionally and are trusted later, which could lead to
the inclusion of arbitrary files. (CVE-2005-3347)
Christopher Kunz discovered that user-supplied input in phpsysinfo is
used unsanitised, causing a HTTP Response splitting problem.
(CVE-2005-3348)
The updated packages have new versions of these subsystems to correct
these issues.
Affected: Corporate 3.0
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
http://www.securityspace.com/smysecure/catid.html?in=MDKSA-2005:212
Risk factor : High
CVSS Score:
7.5
|
