|
|
Family: Gentoo Local Security Checks --> Category: infos
[GLSA-200603-13] PEAR-Auth: Potential authentication bypass Vulnerability Scan
Vulnerability Scan Summary
PEAR-Auth: Potential authentication bypass
Detailed Explanation for this Vulnerability Test
The remote host is affected by the vulnerability described in GLSA-200603-13
(PEAR-Auth: Potential authentication bypass)
Matt Van Gundy discovered that PEAR-Auth did not correctly
validate data passed to the DB and LDAP containers.
Impact
A remote attacker could possibly exploit this vulnerability to
bypass the authentication mechanism by injecting specially crafted
input to the underlying storage containers.
Workaround
There is no known workaround at this time.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0868
Solution:
All PEAR-Auth users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-php/PEAR-Auth-1.2.4"
Threat Level: Medium
Click HERE for more information and discussions on this network vulnerability scan.
|
