Nessus Plugin #17665

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

[GLSA-200503-35] Smarty: Template vulnerability

Family:
Gentoo Local Security Checks
Category:
infos
Copyright:
(C) 2005 Michel Arboi
Summary:
Smarty: Template vulnerability
Version:
$Revision: 1.1 $
Cve_id:
-
Bugtraq_id:
-
Xrefs:
GLSA:200503-35
Description:
The remote host is affected by the vulnerability described in GLSA-200503-35
(Smarty: Template vulnerability)


A vulnerability has been discovered within the regex_replace
modifier of the Smarty templates when allowing access to untrusted
users.

Impact

This issue may allow a remote attacker to bypass the "template
security" feature of Smarty, and execute arbitrary PHP code.

Workaround

Do not grant template access to untrusted users.

References:
http://smarty.php.net/misc/NEWS


Solution:
All Smarty users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-php/smarty-2.6.8"


Risk factor : High
Generiert am 27.04.2005 um 18:49:54 Uhr.